Message	Id	Version	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
User "CBCI-798930-3\N-H1-798930-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	124	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1588	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 5:36:01 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-798930-3\N-H1-798930-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	123	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2764	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 5:06:01 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{B71C8B99-2CB1-4C19-B7CF-AC0131A86A3E}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	122	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:45:31 PM	b71c8b99-2cb1-4c19-b7cf-ac0131a86a3e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Autochk\Proxy" , instance "{B71C8B99-2CB1-4C19-B7CF-AC0131A86A3E}" , action "%windir%\system32\rundll32.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	121	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:45:31 PM	b71c8b99-2cb1-4c19-b7cf-ac0131a86a3e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\rundll32.exe" in instance "{B71C8B99-2CB1-4C19-B7CF-AC0131A86A3E}" of task "\Microsoft\Windows\Autochk\Proxy".	200	1	4	200	1	-9223372036854775808	120	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:45:31 PM	b71c8b99-2cb1-4c19-b7cf-ac0131a86a3e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{B71C8B99-2CB1-4C19-B7CF-AC0131A86A3E}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	119	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:45:31 PM	b71c8b99-2cb1-4c19-b7cf-ac0131a86a3e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Autochk\Proxy" , instance "%windir%\system32\rundll32.exe" with process ID 1044.	129	0	4	129	0	-9223372036854775808	118	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:45:31 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{B71C8B99-2CB1-4C19-B7CF-AC0131A86A3E}" instance of task "\Microsoft\Windows\Autochk\Proxy" due to system startup.	118	0	4	118	0	-9223372036854775808	117	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:45:31 PM	b71c8b99-2cb1-4c19-b7cf-ac0131a86a3e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-798930-3\N-H1-798930-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	116	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1724	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:36:00 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "NT AUTHORITY\SYSTEM" updated Task Scheduler task "\Microsoft\Windows\WindowsUpdate\Scheduled Start"	140	0	4	140	0	-9223372036854775808	115	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:23:47 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{6B26381A-64F2-4A80-93E2-B03B274317E8}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	114	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1724	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:15:30 PM	6b26381a-64f2-4a80-93e2-b03b274317e8	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "{6B26381A-64F2-4A80-93E2-B03B274317E8}" , action "%windir%\System32\XblGameSaveTask.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	113	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1724	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:15:30 PM	6b26381a-64f2-4a80-93e2-b03b274317e8	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\System32\XblGameSaveTask.exe" in instance "{6B26381A-64F2-4A80-93E2-B03B274317E8}" of task "\Microsoft\XblGameSave\XblGameSaveTask".	200	1	4	200	1	-9223372036854775808	112	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1724	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:15:30 PM	6b26381a-64f2-4a80-93e2-b03b274317e8	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{6B26381A-64F2-4A80-93E2-B03B274317E8}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	111	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1724	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:15:30 PM	6b26381a-64f2-4a80-93e2-b03b274317e8	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "%windir%\System32\XblGameSaveTask.exe" with process ID 596.	129	0	4	129	0	-9223372036854775808	110	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1724	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:15:30 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" disabled Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	142	0	4	142	0	-9223372036854775808	109	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:31 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task disabled	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-798930-3\N-H1-798930-3$" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan"	140	0	4	140	0	-9223372036854775808	108	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:31 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{2F8E1D51-CAFB-43E8-96D0-697EB8BC802E}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	107	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:31 PM	2f8e1d51-cafb-43e8-96d0-697eb8bc802e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "{2F8E1D51-CAFB-43E8-96D0-697EB8BC802E}" , action "%systemroot%\system32\usoclient.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	106	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:31 PM	2f8e1d51-cafb-43e8-96d0-697eb8bc802e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	140	0	4	140	0	-9223372036854775808	105	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2896	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:31 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{BF9E3C7D-383B-4131-BC24-B78CD0D8ED9B}" instance of the "\Microsoft\Windows\WindowsUpdate\sih" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	104	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2896	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM	bf9e3c7d-383b-4131-bc24-b78cd0d8ed9b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\WindowsUpdate\sih" , instance "{BF9E3C7D-383B-4131-BC24-B78CD0D8ED9B}" , action "%systemroot%\System32\sihclient.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	103	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2896	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM	bf9e3c7d-383b-4131-bc24-b78cd0d8ed9b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" disabled Task Scheduler task "\Microsoft\Windows\WindowsUpdate\sihboot"	142	0	4	142	0	-9223372036854775808	102	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task disabled	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{59E04C79-2206-4C24-B87C-2836EC093E9B}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	101	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2896	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM	59e04c79-2206-4c24-b87c-2836ec093e9b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{59E04C79-2206-4C24-B87C-2836EC093E9B}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	100	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2896	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM	59e04c79-2206-4c24-b87c-2836ec093e9b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\System32\sihclient.exe" in instance "{BF9E3C7D-383B-4131-BC24-B78CD0D8ED9B}" of task "\Microsoft\Windows\WindowsUpdate\sih".	200	1	4	200	1	-9223372036854775808	99	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2896	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM	bf9e3c7d-383b-4131-bc24-b78cd0d8ed9b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{BF9E3C7D-383B-4131-BC24-B78CD0D8ED9B}" instance of the "\Microsoft\Windows\WindowsUpdate\sih" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	98	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2896	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM	bf9e3c7d-383b-4131-bc24-b78cd0d8ed9b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\WindowsUpdate\sih" , instance "%systemroot%\System32\sihclient.exe" with process ID 3964.	129	0	4	129	0	-9223372036854775808	97	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2896	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{59E04C79-2206-4C24-B87C-2836EC093E9B}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1	4	200	1	-9223372036854775808	96	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM	59e04c79-2206-4c24-b87c-2836ec093e9b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{59E04C79-2206-4C24-B87C-2836EC093E9B}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	95	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM	59e04c79-2206-4c24-b87c-2836ec093e9b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\usoclient.exe" in instance "{2F8E1D51-CAFB-43E8-96D0-697EB8BC802E}" of task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan".	200	1	4	200	1	-9223372036854775808	94	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2864	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM	2f8e1d51-cafb-43e8-96d0-697eb8bc802e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{2F8E1D51-CAFB-43E8-96D0-697EB8BC802E}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	93	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2864	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM	2f8e1d51-cafb-43e8-96d0-697eb8bc802e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 2812.	129	0	4	129	0	-9223372036854775808	92	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "%systemroot%\system32\usoclient.exe" with process ID 672.	129	0	4	129	0	-9223372036854775808	91	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2864	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler could not launch task "\Microsoft\Windows\WindowsUpdate\sih" as scheduled. Instance "{BF9E3C7D-383B-4131-BC24-B78CD0D8ED9B}" is started now as required by the configuration option to start the task when available, if schedule is missed.	114	0	3	114	0	-9223372036854775808	90	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2896	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM	bf9e3c7d-383b-4131-bc24-b78cd0d8ed9b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Missed task started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler could not launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" as scheduled. Instance "{2F8E1D51-CAFB-43E8-96D0-697EB8BC802E}" is started now as required by the configuration option to start the task when available, if schedule is missed.	114	0	3	114	0	-9223372036854775808	89	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2864	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM	2f8e1d51-cafb-43e8-96d0-697eb8bc802e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Missed task started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler could not launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" as scheduled. Instance "{59E04C79-2206-4C24-B87C-2836EC093E9B}" is started now as required by the configuration option to start the task when available, if schedule is missed.	114	0	3	114	0	-9223372036854775808	88	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:09:30 PM	59e04c79-2206-4c24-b87c-2836ec093e9b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Missed task started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{D3DFA850-32A0-489C-8E57-B8D58DF73C7D}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	87	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:08:30 PM	d3dfa850-32a0-489c-8e57-b8d58df73c7d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{D3DFA850-32A0-489C-8E57-B8D58DF73C7D}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	86	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:08:30 PM	d3dfa850-32a0-489c-8e57-b8d58df73c7d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{D3DFA850-32A0-489C-8E57-B8D58DF73C7D}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1	4	200	1	-9223372036854775808	85	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:08:30 PM	d3dfa850-32a0-489c-8e57-b8d58df73c7d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{D3DFA850-32A0-489C-8E57-B8D58DF73C7D}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	84	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:08:30 PM	d3dfa850-32a0-489c-8e57-b8d58df73c7d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 4052.	129	0	4	129	0	-9223372036854775808	83	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:08:30 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{D3DFA850-32A0-489C-8E57-B8D58DF73C7D}" instance of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" due to system startup.	118	0	4	118	0	-9223372036854775808	82	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:08:30 PM	d3dfa850-32a0-489c-8e57-b8d58df73c7d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-798930-3\N-H1-798930-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	81	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:08:02 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{4A5C51C7-D4FE-4AE0-AEC1-206167284E38}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	80	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2532	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:31 PM	4a5c51c7-d4fe-4ae0-aec1-206167284e38	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "{4A5C51C7-D4FE-4AE0-AEC1-206167284E38}" , action "%systemroot%\system32\cmd.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	79	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2532	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:31 PM	4a5c51c7-d4fe-4ae0-aec1-206167284e38	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\cmd.exe" in instance "{4A5C51C7-D4FE-4AE0-AEC1-206167284E38}" of task "\Microsoft\Windows\Software Inventory Logging\Configuration".	200	1	4	200	1	-9223372036854775808	78	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2532	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:30 PM	4a5c51c7-d4fe-4ae0-aec1-206167284e38	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{4A5C51C7-D4FE-4AE0-AEC1-206167284E38}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	77	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2532	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:30 PM	4a5c51c7-d4fe-4ae0-aec1-206167284e38	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "%systemroot%\system32\cmd.exe" with process ID 3764.	129	0	4	129	0	-9223372036854775808	76	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2532	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:30 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{4A5C51C7-D4FE-4AE0-AEC1-206167284E38}" instance of task "\Microsoft\Windows\Software Inventory Logging\Configuration" due to system startup.	118	0	4	118	0	-9223372036854775808	75	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2532	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:30 PM	4a5c51c7-d4fe-4ae0-aec1-206167284e38	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{8EF4C4CF-56F0-40D6-9A24-7DAC4CF40977}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	74	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM	8ef4c4cf-56f0-40d6-9a24-7dac4cf40977	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{8EF4C4CF-56F0-40D6-9A24-7DAC4CF40977}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	73	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM	8ef4c4cf-56f0-40d6-9a24-7dac4cf40977	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{8EF4C4CF-56F0-40D6-9A24-7DAC4CF40977}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	72	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM	8ef4c4cf-56f0-40d6-9a24-7dac4cf40977	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{8EF4C4CF-56F0-40D6-9A24-7DAC4CF40977}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	71	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM	8ef4c4cf-56f0-40d6-9a24-7dac4cf40977	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 3136.	129	0	4	129	0	-9223372036854775808	70	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{2D5C841C-D2D2-4BDB-9C0B-3D0233821FA7}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	69	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2764	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM	2d5c841c-d2d2-4bdb-9c0b-3d0233821fa7	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{2D5C841C-D2D2-4BDB-9C0B-3D0233821FA7}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	68	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2764	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM	2d5c841c-d2d2-4bdb-9c0b-3d0233821fa7	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{2D5C841C-D2D2-4BDB-9C0B-3D0233821FA7}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1	4	200	1	-9223372036854775808	67	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2764	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM	2d5c841c-d2d2-4bdb-9c0b-3d0233821fa7	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{2D5C841C-D2D2-4BDB-9C0B-3D0233821FA7}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	66	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2764	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM	2d5c841c-d2d2-4bdb-9c0b-3d0233821fa7	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "taskhostw.exe" with process ID 3384.	129	0	4	129	0	-9223372036854775808	65	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2764	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{FAA50C86-CEA7-48C6-87D9-A244A699E29F}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	64	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1960	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM	faa50c86-cea7-48c6-87d9-a244a699e29f	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{FAA50C86-CEA7-48C6-87D9-A244A699E29F}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	63	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1960	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM	faa50c86-cea7-48c6-87d9-a244a699e29f	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{FAA50C86-CEA7-48C6-87D9-A244A699E29F}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	62	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM	faa50c86-cea7-48c6-87d9-a244a699e29f	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{FAA50C86-CEA7-48C6-87D9-A244A699E29F}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	61	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM	faa50c86-cea7-48c6-87d9-a244a699e29f	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 3820.	129	0	4	129	0	-9223372036854775808	60	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:16 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-798930-3\N-H1-798930-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	59	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:10 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{082CA952-81D0-4B9C-8718-3A318B7395C2}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	58	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM	082ca952-81d0-4b9c-8718-3a318b7395c2	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{082CA952-81D0-4B9C-8718-3A318B7395C2}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	57	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM	082ca952-81d0-4b9c-8718-3a318b7395c2	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{082CA952-81D0-4B9C-8718-3A318B7395C2}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	56	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM	082ca952-81d0-4b9c-8718-3a318b7395c2	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{082CA952-81D0-4B9C-8718-3A318B7395C2}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	55	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM	082ca952-81d0-4b9c-8718-3a318b7395c2	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 2608.	129	0	4	129	0	-9223372036854775808	54	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{31F3C0EC-9A77-4969-8AE4-B6ECD6A6FE6E}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	53	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM	31f3c0ec-9a77-4969-8ae4-b6ecd6a6fe6e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{31F3C0EC-9A77-4969-8AE4-B6ECD6A6FE6E}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	52	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM	31f3c0ec-9a77-4969-8ae4-b6ecd6a6fe6e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{31F3C0EC-9A77-4969-8AE4-B6ECD6A6FE6E}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1	4	200	1	-9223372036854775808	51	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM	31f3c0ec-9a77-4969-8ae4-b6ecd6a6fe6e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{31F3C0EC-9A77-4969-8AE4-B6ECD6A6FE6E}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	50	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM	31f3c0ec-9a77-4969-8ae4-b6ecd6a6fe6e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "taskhostw.exe" with process ID 3948.	129	0	4	129	0	-9223372036854775808	49	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{3A5500FB-7532-440D-A8F2-1A86FC518B39}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	48	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM	3a5500fb-7532-440d-a8f2-1a86fc518b39	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{3A5500FB-7532-440D-A8F2-1A86FC518B39}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	47	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM	3a5500fb-7532-440d-a8f2-1a86fc518b39	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{3A5500FB-7532-440D-A8F2-1A86FC518B39}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	46	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM	3a5500fb-7532-440d-a8f2-1a86fc518b39	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{3A5500FB-7532-440D-A8F2-1A86FC518B39}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	45	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM	3a5500fb-7532-440d-a8f2-1a86fc518b39	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 3984.	129	0	4	129	0	-9223372036854775808	44	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:06:07 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{F0A81294-0991-4084-8739-93CA2FD844C3}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	43	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2256	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:52 PM	f0a81294-0991-4084-8739-93ca2fd844c3	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{F0A81294-0991-4084-8739-93CA2FD844C3}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	42	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2256	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:52 PM	f0a81294-0991-4084-8739-93ca2fd844c3	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{5AC9B804-2D75-4DB2-9D0D-30703F8DCA65}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	41	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:51 PM	5ac9b804-2d75-4db2-9d0d-30703f8dca65	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{5AC9B804-2D75-4DB2-9D0D-30703F8DCA65}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	40	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:51 PM	5ac9b804-2d75-4db2-9d0d-30703f8dca65	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{CE0E6C1E-5727-457F-AC69-6D9BC567A5A6}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	39	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:51 PM	ce0e6c1e-5727-457f-ac69-6d9bc567a5a6	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{CE0E6C1E-5727-457F-AC69-6D9BC567A5A6}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	38	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:51 PM	ce0e6c1e-5727-457f-ac69-6d9bc567a5a6	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{CE0E6C1E-5727-457F-AC69-6D9BC567A5A6}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	37	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2484	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:51 PM	ce0e6c1e-5727-457f-ac69-6d9bc567a5a6	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{CE0E6C1E-5727-457F-AC69-6D9BC567A5A6}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	36	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2484	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:51 PM	ce0e6c1e-5727-457f-ac69-6d9bc567a5a6	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{16FD82EB-5FE8-41B5-8D3C-B9FB1C9FAB43}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	35	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:51 PM	16fd82eb-5fe8-41b5-8d3c-b9fb1c9fab43	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{16FD82EB-5FE8-41B5-8D3C-B9FB1C9FAB43}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	34	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:51 PM	16fd82eb-5fe8-41b5-8d3c-b9fb1c9fab43	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{16FD82EB-5FE8-41B5-8D3C-B9FB1C9FAB43}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	33	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	3216	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:51 PM	16fd82eb-5fe8-41b5-8d3c-b9fb1c9fab43	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{16FD82EB-5FE8-41B5-8D3C-B9FB1C9FAB43}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	32	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	3216	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:51 PM	16fd82eb-5fe8-41b5-8d3c-b9fb1c9fab43	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{77AEA9E9-87ED-4EDB-83EF-82F9D5F9F1B2}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	31	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:51 PM	77aea9e9-87ed-4edb-83ef-82f9d5f9f1b2	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{77AEA9E9-87ED-4EDB-83EF-82F9D5F9F1B2}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	30	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:51 PM	77aea9e9-87ed-4edb-83ef-82f9d5f9f1b2	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{494760ED-CA50-41BC-8DED-355A9D486CEA}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	29	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:50 PM	494760ed-ca50-41bc-8ded-355a9d486cea	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{494760ED-CA50-41BC-8DED-355A9D486CEA}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	28	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:50 PM	494760ed-ca50-41bc-8ded-355a9d486cea	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{75CB18A8-0FDA-4DE4-929A-AB18F7FC1791}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	27	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:50 PM	75cb18a8-0fda-4de4-929a-ab18f7fc1791	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{75CB18A8-0FDA-4DE4-929A-AB18F7FC1791}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	26	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:50 PM	75cb18a8-0fda-4de4-929a-ab18f7fc1791	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{75CB18A8-0FDA-4DE4-929A-AB18F7FC1791}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1	4	200	1	-9223372036854775808	25	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2484	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:50 PM	75cb18a8-0fda-4de4-929a-ab18f7fc1791	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{75CB18A8-0FDA-4DE4-929A-AB18F7FC1791}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	24	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2484	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:50 PM	75cb18a8-0fda-4de4-929a-ab18f7fc1791	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{E16E9A45-9B96-4C86-8385-DD4599C0B437}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	23	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:50 PM	e16e9a45-9b96-4c86-8385-dd4599c0b437	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{E16E9A45-9B96-4C86-8385-DD4599C0B437}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	22	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2320	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:50 PM	e16e9a45-9b96-4c86-8385-dd4599c0b437	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{F0A81294-0991-4084-8739-93CA2FD844C3}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1	4	200	1	-9223372036854775808	21	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:50 PM	f0a81294-0991-4084-8739-93ca2fd844c3	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{F0A81294-0991-4084-8739-93CA2FD844C3}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	20	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:50 PM	f0a81294-0991-4084-8739-93ca2fd844c3	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 3932.	129	0	4	129	0	-9223372036854775808	19	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:50 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{00000000-0000-0000-0000-000000000000}" instance of task "\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents" according to an event trigger.	108	0	4	108	0	-9223372036854775808	18	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:49 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered on event	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{494760ED-CA50-41BC-8DED-355A9D486CEA}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	17	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:40 PM	494760ed-ca50-41bc-8ded-355a9d486cea	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{494760ED-CA50-41BC-8DED-355A9D486CEA}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	16	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:40 PM	494760ed-ca50-41bc-8ded-355a9d486cea	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{494760ED-CA50-41BC-8DED-355A9D486CEA}" instance of task "\Microsoft\Windows\CertificateServicesClient\SystemTask" due to system startup.	118	0	4	118	0	-9223372036854775808	15	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:40 PM	494760ed-ca50-41bc-8ded-355a9d486cea	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{336192D8-7335-4AEB-9B48-4C6BD386CCFE}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	14	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:38 PM	336192d8-7335-4aeb-9b48-4c6bd386ccfe	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{336192D8-7335-4AEB-9B48-4C6BD386CCFE}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	13	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2916	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:38 PM	336192d8-7335-4aeb-9b48-4c6bd386ccfe	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{75CB18A8-0FDA-4DE4-929A-AB18F7FC1791}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" and will launch it as soon as instance "{E16E9A45-9B96-4C86-8385-DD4599C0B437}" completes.	324	0	3	324	0	-9223372036854775808	12	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:34 PM	75cb18a8-0fda-4de4-929a-ab18f7fc1791	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{CE0E6C1E-5727-457F-AC69-6D9BC567A5A6}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{77AEA9E9-87ED-4EDB-83EF-82F9D5F9F1B2}" completes.	324	0	3	324	0	-9223372036854775808	11	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2896	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:34 PM	ce0e6c1e-5727-457f-ac69-6d9bc567a5a6	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{336192D8-7335-4AEB-9B48-4C6BD386CCFE}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	10	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:34 PM	336192d8-7335-4aeb-9b48-4c6bd386ccfe	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{336192D8-7335-4AEB-9B48-4C6BD386CCFE}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	9	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:34 PM	336192d8-7335-4aeb-9b48-4c6bd386ccfe	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{16FD82EB-5FE8-41B5-8D3C-B9FB1C9FAB43}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{77AEA9E9-87ED-4EDB-83EF-82F9D5F9F1B2}" completes.	324	0	3	324	0	-9223372036854775808	8	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1724	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:32 PM	16fd82eb-5fe8-41b5-8d3c-b9fb1c9fab43	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{E16E9A45-9B96-4C86-8385-DD4599C0B437}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1	4	200	1	-9223372036854775808	7	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2256	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:32 PM	e16e9a45-9b96-4c86-8385-dd4599c0b437	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{E16E9A45-9B96-4C86-8385-DD4599C0B437}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	6	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2256	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:32 PM	e16e9a45-9b96-4c86-8385-dd4599c0b437	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{5AC9B804-2D75-4DB2-9D0D-30703F8DCA65}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	5	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1724	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:32 PM	5ac9b804-2d75-4db2-9d0d-30703f8dca65	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{5AC9B804-2D75-4DB2-9D0D-30703F8DCA65}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	4	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1724	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:32 PM	5ac9b804-2d75-4db2-9d0d-30703f8dca65	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{77AEA9E9-87ED-4EDB-83EF-82F9D5F9F1B2}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	3	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:31 PM	77aea9e9-87ed-4edb-83ef-82f9d5f9f1b2	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{77AEA9E9-87ED-4EDB-83EF-82F9D5F9F1B2}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	2	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:31 PM	77aea9e9-87ed-4edb-83ef-82f9d5f9f1b2	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 3128.	129	0	4	129	0	-9223372036854775808	1	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2160	n-h1-798930-3.cbci-798930-3.local	S-1-5-18	7/9/2021 4:05:31 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]