Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	156	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2012	496	n-h1-768852-4.cbci-768852-4.local	S-1-5-19	1/14/2021 3:40:32 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {F53565D3-0B5E-4FF7-B3BD-67E89DEC0939} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	155	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2012	496	n-h1-768852-4.cbci-768852-4.local	S-1-5-19	1/14/2021 3:40:28 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {F53565D3-0B5E-4FF7-B3BD-67E89DEC0939} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	154	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2012	496	n-h1-768852-4.cbci-768852-4.local	S-1-5-19	1/14/2021 3:40:28 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	153	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2012	2032	n-h1-768852-4.cbci-768852-4.local	S-1-5-19	1/14/2021 3:40:28 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {6B05CCB8-F702-46A4-98AF-90082B052329} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	152	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2012	496	n-h1-768852-4.cbci-768852-4.local	S-1-5-19	1/14/2021 3:40:28 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	151	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2012	2032	n-h1-768852-4.cbci-768852-4.local	S-1-5-19	1/14/2021 3:40:28 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {6B05CCB8-F702-46A4-98AF-90082B052329} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	150	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2012	496	n-h1-768852-4.cbci-768852-4.local	S-1-5-19	1/14/2021 3:40:28 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	149	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	2012	2032	n-h1-768852-4.cbci-768852-4.local	S-1-5-19	1/14/2021 3:40:28 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	148	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2084	n-h1-768852-4	S-1-5-19	1/14/2021 3:40:06 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	147	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2084	n-h1-768852-4	S-1-5-19	1/14/2021 3:40:06 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	146	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2084	n-h1-768852-4	S-1-5-19	1/14/2021 3:40:06 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {6B05CCB8-F702-46A4-98AF-90082B052329} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	145	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2072	n-h1-768852-4	S-1-5-19	1/14/2021 3:01:55 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {6B05CCB8-F702-46A4-98AF-90082B052329} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	144	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2072	n-h1-768852-4	S-1-5-19	1/14/2021 3:01:55 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter removal Interface: {6B05CCB8-F702-46A4-98AF-90082B052329} Type: Ethernet.	1010	0		4	0	0	-9223372036854775776	143	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2072	n-h1-768852-4	S-1-5-19	1/14/2021 3:01:55 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter removal Interface: {6B05CCB8-F702-46A4-98AF-90082B052329} Type: Ethernet.	1027	0		4	0	0	-9223372036854775776	142	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2072	n-h1-768852-4	S-1-5-19	1/14/2021 3:01:55 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	141	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2072	n-h1-768852-4	S-1-5-19	1/14/2021 2:59:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {F53565D3-0B5E-4FF7-B3BD-67E89DEC0939} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	140	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2072	n-h1-768852-4	S-1-5-19	1/14/2021 2:58:49 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {F53565D3-0B5E-4FF7-B3BD-67E89DEC0939} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	139	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2072	n-h1-768852-4	S-1-5-19	1/14/2021 2:58:49 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	138	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2056	n-h1-768852-4	S-1-5-19	1/14/2021 2:58:49 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {6B05CCB8-F702-46A4-98AF-90082B052329} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	137	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2072	n-h1-768852-4	S-1-5-19	1/14/2021 2:58:49 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	136	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2056	n-h1-768852-4	S-1-5-19	1/14/2021 2:58:49 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {6B05CCB8-F702-46A4-98AF-90082B052329} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	135	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2072	n-h1-768852-4	S-1-5-19	1/14/2021 2:58:49 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	134	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1104	2056	n-h1-768852-4	S-1-5-19	1/14/2021 2:58:49 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	133	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1852	1956	n-h1-768852-4	S-1-5-19	1/14/2021 2:58:17 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	132	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1852	1956	WIN-5T344G8GM1H	S-1-5-19	1/14/2021 2:58:17 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	131	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1852	1956	WIN-5T344G8GM1H	S-1-5-19	1/14/2021 2:58:17 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCM Preferred Order List: 0: {6B05CCB8-F702-46A4-98AF-90082B052329}, 6b05ccb8-f702-46a4-98af-90082b052329, 1 1: {F53565D3-0B5E-4FF7-B3BD-67E89DEC0939}, f53565d3-0b5e-4ff7-b3bd-67e89dec0939, 1 2: {518CDFA4-5492-4D9E-BEAA-908825A4A289}, 518cdfa4-5492-4d9e-beaa-908825a4a289, 1 3: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}, 5c5d9a3a-40d7-47b4-b915-59c9831563df, 1	1020	0		4	0	0	-9223372036854775776	130	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1852	1892	WIN-5T344G8GM1H	S-1-5-19	1/14/2021 2:57:18 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {6B05CCB8-F702-46A4-98AF-90082B052329} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	129	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1852	1892	WIN-5T344G8GM1H	S-1-5-19	1/14/2021 2:57:18 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {6B05CCB8-F702-46A4-98AF-90082B052329} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	128	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1852	1892	WIN-5T344G8GM1H	S-1-5-19	1/14/2021 2:57:18 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCM Preferred Order List: 0: {F53565D3-0B5E-4FF7-B3BD-67E89DEC0939}, f53565d3-0b5e-4ff7-b3bd-67e89dec0939, 1 1: {518CDFA4-5492-4D9E-BEAA-908825A4A289}, 518cdfa4-5492-4d9e-beaa-908825a4a289, 1 2: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}, 5c5d9a3a-40d7-47b4-b915-59c9831563df, 1	1020	0		4	0	0	-9223372036854775776	127	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1852	1892	WIN-5T344G8GM1H	S-1-5-19	1/14/2021 2:57:18 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	126	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1852	1880	WIN-5T344G8GM1H	S-1-5-19	1/14/2021 2:57:18 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {F53565D3-0B5E-4FF7-B3BD-67E89DEC0939} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	125	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1852	1892	WIN-5T344G8GM1H	S-1-5-19	1/14/2021 2:57:18 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {F53565D3-0B5E-4FF7-B3BD-67E89DEC0939} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	124	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1852	1892	WIN-5T344G8GM1H	S-1-5-19	1/14/2021 2:57:18 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	123	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1852	1880	WIN-5T344G8GM1H	S-1-5-19	1/14/2021 2:57:18 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	122	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1852	1880	WIN-5T344G8GM1H	S-1-5-19	1/14/2021 2:57:18 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	121	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1892	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:48:13 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	120	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1892	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:48:13 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	119	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1892	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:48:13 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	118	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1816	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:48:12 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	117	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1816	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:33 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	116	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1816	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:30 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	115	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1792	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:30 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	114	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1792	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:30 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	113	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1816	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:30 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	112	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1816	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:30 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	111	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1724	1792	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:29 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	110	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1640	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	109	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1640	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	108	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1640	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:41:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	107	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1624	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:40:27 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	106	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1624	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:19 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	105	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1624	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:17 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	104	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1604	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	103	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1624	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	102	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1624	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	101	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1604	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	100	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1532	1604	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:15 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	99	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1556	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	98	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1556	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	97	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1556	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:27:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	96	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1492	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	95	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1540	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	94	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1540	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	93	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1492	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	92	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1420	1492	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	91	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1692	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:23 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	90	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1692	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:23 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	89	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1692	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:23 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	88	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:26:19 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	87	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:05 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	86	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:03 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	85	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1528	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	84	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	83	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	82	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1528	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	81	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1472	1528	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:23:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	80	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1648	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:22:50 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	79	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1648	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:22:50 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	78	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1648	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:22:50 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	77	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:22:48 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	76	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:19:17 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	75	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:19:17 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter removal Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1010	0		4	0	0	-9223372036854775776	74	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:19:16 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter removal Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1027	0		4	0	0	-9223372036854775776	73	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 9:19:16 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	72	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:50 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	71	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:49 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	70	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1620	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:48 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	69	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1620	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:48 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	68	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:48 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	67	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1636	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:48 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	66	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1436	1620	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:48 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	65	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1700	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	64	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1700	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	63	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1700	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:40 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	62	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:54:39 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	61	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:56 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	60	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:54 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	59	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1648	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:02 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	58	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:02 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	57	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1648	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:02 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	56	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1688	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:02 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	55	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1512	1648	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:50:02 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	54	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1452	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:49:46 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	53	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1452	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:49:46 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	52	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1452	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:49:46 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	51	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1440	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:45:56 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	50	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1440	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:24:01 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	49	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1440	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:24:00 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCM Preferred Order List: 0: {518CDFA4-5492-4D9E-BEAA-908825A4A289}, 518cdfa4-5492-4d9e-beaa-908825a4a289, 1 1: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}, 5c5d9a3a-40d7-47b4-b915-59c9831563df, 1	1020	0		4	0	0	-9223372036854775776	48	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1440	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:23:57 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	47	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1440	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:23:57 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	46	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1440	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:23:57 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	45	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1388	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:23:55 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	44	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1388	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:23:55 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	43	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1324	1388	WIN-5T344G8GM1H	S-1-5-19	1/19/2018 8:23:55 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	42	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1712	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:44:39 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	41	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1712	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:44:39 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	40	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1712	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:44:39 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	39	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1688	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:44:38 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	38	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1688	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:07:02 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	37	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1688	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:07:01 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	36	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1620	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:24 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	35	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1688	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:24 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	34	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1688	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:24 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	33	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1620	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:24 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	32	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1396	1620	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:24 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	31	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1728	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:09 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	30	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1728	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:09 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	29	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1728	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:06:09 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	28	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1700	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 6:02:38 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	27	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1700	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:43:07 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	26	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1700	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:43:05 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	25	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1668	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:42:11 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	24	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1700	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:42:11 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	23	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1700	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:42:11 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	22	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1668	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:42:11 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	21	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1408	1668	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:42:11 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	20	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1944	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:41:55 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	19	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1944	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:41:55 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	18	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1944	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:41:55 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged off the session	1006	0		4	0	0	-9223372036854775776	17	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1932	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:35:49 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A user has logged on to the session	1006	0		4	0	0	-9223372036854775776	16	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1932	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:02:11 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
A Terminal Services session change was processed. Reason: A session was connected to the console terminal	1006	0		4	0	0	-9223372036854775776	15	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1932	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:02:09 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	14	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1920	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:01:59 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	13	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1920	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:01:59 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	12	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1932	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:01:59 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	11	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1932	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:01:59 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	10	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1896	1920	WIN-5T344G8GM1H	S-1-5-19	1/16/2018 5:01:58 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete Service Shutdown	10004	0		4	0	0	-9223372036854775808	9	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1712	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 9:01:42 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientUnregister - Status [0x0]	4028	0		4	0	0	-9223372036854775776	8	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1712	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 9:01:42 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start Service Shutdown	10003	0		4	0	0	-9223372036854775808	7	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1712	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 9:01:42 AM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCM Preferred Order List: 0: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}, 5c5d9a3a-40d7-47b4-b915-59c9831563df, 1	1020	0		4	0	0	-9223372036854775776	6	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1704	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 5:01:21 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an L2 adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1009	0		4	0	0	-9223372036854775776	5	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1704	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 5:01:21 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
CDE reported an NDIS adapter arrival Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF} Type: Ethernet.	1026	0		4	0	0	-9223372036854775776	4	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1704	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 5:01:21 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Complete WCM Service Startup	10002	0		4	0	0	-9223372036854775808	3	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1684	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 5:01:14 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WcmSvc CmPdcActivationClientRegister - Status [0x0]	4027	0		4	0	0	-9223372036854775776	2	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1684	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 5:01:14 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WCMSVC: Start WCM Service Startup	10001	0		4	0	0	-9223372036854775808	1	Microsoft-Windows-Wcmsvc	67d07935-283a-4791-8f8d-fa9117f3e6f2	Microsoft-Windows-Wcmsvc/Operational	1636	1684	WIN-PD8DQPRRTAO	S-1-5-19	1/16/2018 5:01:14 PM			microsoft-windows-wcmsvc/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]