Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
User "CBCI-799684-4\N-H1-799684-4$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	114	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 4:21:16 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-799684-4\N-H1-799684-4$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	113	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	1100	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:51:16 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{0DE7FAE6-C68A-4954-A4FE-5DC0583A90D8}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	112	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	1100	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:30:45 PM	0de7fae6-c68a-4954-a4fe-5dc0583a90d8		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Autochk\Proxy" , instance "{0DE7FAE6-C68A-4954-A4FE-5DC0583A90D8}" , action "%windir%\system32\rundll32.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	111	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	1100	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:30:45 PM	0de7fae6-c68a-4954-a4fe-5dc0583a90d8		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\rundll32.exe" in instance "{0DE7FAE6-C68A-4954-A4FE-5DC0583A90D8}" of task "\Microsoft\Windows\Autochk\Proxy".	200	1		4	200	1	-9223372036854775808	110	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	1100	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:30:45 PM	0de7fae6-c68a-4954-a4fe-5dc0583a90d8		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{0DE7FAE6-C68A-4954-A4FE-5DC0583A90D8}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	109	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	1100	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:30:45 PM	0de7fae6-c68a-4954-a4fe-5dc0583a90d8		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Autochk\Proxy" , instance "%windir%\system32\rundll32.exe" with process ID 2760.	129	0		4	129	0	-9223372036854775808	108	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	1100	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:30:45 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{0DE7FAE6-C68A-4954-A4FE-5DC0583A90D8}" instance of task "\Microsoft\Windows\Autochk\Proxy" due to system startup.	118	0		4	118	0	-9223372036854775808	107	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	1100	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:30:45 PM	0de7fae6-c68a-4954-a4fe-5dc0583a90d8		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "NT AUTHORITY\SYSTEM" updated Task Scheduler task "\Microsoft\Windows\WindowsUpdate\Scheduled Start"	140	0		4	140	0	-9223372036854775808	106	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	1604	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:26:49 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-799684-4\N-H1-799684-4$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	105	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:21:15 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{4B2AA38C-0075-4061-88B5-911F3AAEBCDA}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	104	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2816	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:00:44 PM	4b2aa38c-0075-4061-88b5-911f3aaebcda		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "{4B2AA38C-0075-4061-88B5-911F3AAEBCDA}" , action "%windir%\System32\XblGameSaveTask.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	103	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2816	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:00:44 PM	4b2aa38c-0075-4061-88b5-911f3aaebcda		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\System32\XblGameSaveTask.exe" in instance "{4B2AA38C-0075-4061-88B5-911F3AAEBCDA}" of task "\Microsoft\XblGameSave\XblGameSaveTask".	200	1		4	200	1	-9223372036854775808	102	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2816	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:00:44 PM	4b2aa38c-0075-4061-88b5-911f3aaebcda		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{4B2AA38C-0075-4061-88B5-911F3AAEBCDA}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	101	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2816	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:00:44 PM	4b2aa38c-0075-4061-88b5-911f3aaebcda		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "%windir%\System32\XblGameSaveTask.exe" with process ID 1424.	129	0		4	129	0	-9223372036854775808	100	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2816	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 3:00:44 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" disabled Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	142	0		4	142	0	-9223372036854775808	99	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:46 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task disabled	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-799684-4\N-H1-799684-4$" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan"	140	0		4	140	0	-9223372036854775808	98	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{D2C9E990-F32F-48AA-AE25-5C1FD2128D95}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	97	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM	d2c9e990-f32f-48aa-ae25-5c1fd2128d95		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "{D2C9E990-F32F-48AA-AE25-5C1FD2128D95}" , action "%systemroot%\system32\usoclient.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	96	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM	d2c9e990-f32f-48aa-ae25-5c1fd2128d95		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	140	0		4	140	0	-9223372036854775808	95	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	1552	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{99A83E6D-1EDB-4DA5-9BBF-4F9EE5A25220}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	94	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM	99a83e6d-1edb-4da5-9bbf-4f9ee5a25220		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{99A83E6D-1EDB-4DA5-9BBF-4F9EE5A25220}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	93	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM	99a83e6d-1edb-4da5-9bbf-4f9ee5a25220		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{99A83E6D-1EDB-4DA5-9BBF-4F9EE5A25220}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1		4	200	1	-9223372036854775808	92	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM	99a83e6d-1edb-4da5-9bbf-4f9ee5a25220		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{99A83E6D-1EDB-4DA5-9BBF-4F9EE5A25220}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	91	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM	99a83e6d-1edb-4da5-9bbf-4f9ee5a25220		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 1060.	129	0		4	129	0	-9223372036854775808	90	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{99A83E6D-1EDB-4DA5-9BBF-4F9EE5A25220}" instance of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" due to system startup.	118	0		4	118	0	-9223372036854775808	89	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM	99a83e6d-1edb-4da5-9bbf-4f9ee5a25220		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\usoclient.exe" in instance "{D2C9E990-F32F-48AA-AE25-5C1FD2128D95}" of task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan".	200	1		4	200	1	-9223372036854775808	88	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM	d2c9e990-f32f-48aa-ae25-5c1fd2128d95		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{D2C9E990-F32F-48AA-AE25-5C1FD2128D95}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	87	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM	d2c9e990-f32f-48aa-ae25-5c1fd2128d95		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "%systemroot%\system32\usoclient.exe" with process ID 3964.	129	0		4	129	0	-9223372036854775808	86	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler could not launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" as scheduled. Instance "{D2C9E990-F32F-48AA-AE25-5C1FD2128D95}" is started now as required by the configuration option to start the task when available, if schedule is missed.	114	0		3	114	0	-9223372036854775808	85	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:45 PM	d2c9e990-f32f-48aa-ae25-5c1fd2128d95		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Missed task started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-799684-4\N-H1-799684-4$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	84	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:53:16 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{769BEF4C-4CE4-4CBE-BA4B-EF185F826136}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	83	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	1552	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:52:35 PM	769bef4c-4ce4-4cbe-ba4b-ef185f826136		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "{769BEF4C-4CE4-4CBE-BA4B-EF185F826136}" , action "%windir%\system32\compattelrunner.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	82	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	1552	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:52:35 PM	769bef4c-4ce4-4cbe-ba4b-ef185f826136		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{92465DC0-7981-42F1-BE4E-2E558D0B306D}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	81	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	1552	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:45 PM	92465dc0-7981-42f1-be4e-2e558d0b306d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "{92465DC0-7981-42F1-BE4E-2E558D0B306D}" , action "%systemroot%\system32\cmd.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	80	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	1552	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:45 PM	92465dc0-7981-42f1-be4e-2e558d0b306d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\cmd.exe" in instance "{92465DC0-7981-42F1-BE4E-2E558D0B306D}" of task "\Microsoft\Windows\Software Inventory Logging\Configuration".	200	1		4	200	1	-9223372036854775808	79	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2604	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:45 PM	92465dc0-7981-42f1-be4e-2e558d0b306d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{92465DC0-7981-42F1-BE4E-2E558D0B306D}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	78	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2604	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:45 PM	92465dc0-7981-42f1-be4e-2e558d0b306d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "%systemroot%\system32\cmd.exe" with process ID 4804.	129	0		4	129	0	-9223372036854775808	77	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2604	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:45 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{92465DC0-7981-42F1-BE4E-2E558D0B306D}" instance of task "\Microsoft\Windows\Software Inventory Logging\Configuration" due to system startup.	118	0		4	118	0	-9223372036854775808	76	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2604	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:45 PM	92465dc0-7981-42f1-be4e-2e558d0b306d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-799684-4\N-H1-799684-4$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	75	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2604	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:24 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{64A6D860-09E5-46BE-B064-58891D42E95B}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	74	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2344	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM	64a6d860-09e5-46be-b064-58891d42e95b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{64A6D860-09E5-46BE-B064-58891D42E95B}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	73	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2344	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM	64a6d860-09e5-46be-b064-58891d42e95b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{64A6D860-09E5-46BE-B064-58891D42E95B}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	72	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2344	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM	64a6d860-09e5-46be-b064-58891d42e95b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{64A6D860-09E5-46BE-B064-58891D42E95B}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	71	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2344	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM	64a6d860-09e5-46be-b064-58891d42e95b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 4172.	129	0		4	129	0	-9223372036854775808	70	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2344	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{D0FF0235-2D48-412C-AC53-BD6570773A45}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	69	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2604	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM	d0ff0235-2d48-412c-ac53-bd6570773a45		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{D0FF0235-2D48-412C-AC53-BD6570773A45}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	68	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2604	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM	d0ff0235-2d48-412c-ac53-bd6570773a45		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{F34FE50D-9012-4675-8850-37F431503499}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	67	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2604	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM	f34fe50d-9012-4675-8850-37f431503499		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{F34FE50D-9012-4675-8850-37F431503499}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	66	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2604	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM	f34fe50d-9012-4675-8850-37f431503499		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{F34FE50D-9012-4675-8850-37F431503499}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	65	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM	f34fe50d-9012-4675-8850-37f431503499		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{F34FE50D-9012-4675-8850-37F431503499}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	64	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM	f34fe50d-9012-4675-8850-37f431503499		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{D0FF0235-2D48-412C-AC53-BD6570773A45}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	63	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM	d0ff0235-2d48-412c-ac53-bd6570773a45		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{D0FF0235-2D48-412C-AC53-BD6570773A45}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	62	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM	d0ff0235-2d48-412c-ac53-bd6570773a45		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 2988.	129	0		4	129	0	-9223372036854775808	61	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:16 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{3244A965-F307-42E3-A75C-4ACE6E0836C9}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	60	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:09 PM	3244a965-f307-42e3-a75c-4ace6e0836c9		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{3244A965-F307-42E3-A75C-4ACE6E0836C9}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	59	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:09 PM	3244a965-f307-42e3-a75c-4ace6e0836c9		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{86181BB9-33E0-42E0-A482-47753041B6B0}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	58	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:09 PM	86181bb9-33e0-42e0-a482-47753041b6b0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{86181BB9-33E0-42E0-A482-47753041B6B0}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	57	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:09 PM	86181bb9-33e0-42e0-a482-47753041b6b0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{7ADA0697-C9B0-4221-BDA2-4E9AE67464BA}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	56	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	7ada0697-c9b0-4221-bda2-4e9ae67464ba		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{7ADA0697-C9B0-4221-BDA2-4E9AE67464BA}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	55	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	7ada0697-c9b0-4221-bda2-4e9ae67464ba		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{5E887156-22A9-4352-A858-ADD7A63AC95F}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	54	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	5e887156-22a9-4352-a858-add7a63ac95f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{5E887156-22A9-4352-A858-ADD7A63AC95F}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	53	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	5e887156-22a9-4352-a858-add7a63ac95f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{B75D9A0E-4DDB-41AC-8B68-09760FB450DD}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	52	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	b75d9a0e-4ddb-41ac-8b68-09760fb450dd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{B75D9A0E-4DDB-41AC-8B68-09760FB450DD}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	51	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	b75d9a0e-4ddb-41ac-8b68-09760fb450dd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{B75D9A0E-4DDB-41AC-8B68-09760FB450DD}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	50	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	3636	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	b75d9a0e-4ddb-41ac-8b68-09760fb450dd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{B75D9A0E-4DDB-41AC-8B68-09760FB450DD}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	49	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	3636	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	b75d9a0e-4ddb-41ac-8b68-09760fb450dd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{6EDCF85B-37FC-4A62-BDC3-7A9D86D8A37E}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	48	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	6edcf85b-37fc-4a62-bdc3-7a9d86d8a37e		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{6EDCF85B-37FC-4A62-BDC3-7A9D86D8A37E}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	47	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	6edcf85b-37fc-4a62-bdc3-7a9d86d8a37e		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{6EDCF85B-37FC-4A62-BDC3-7A9D86D8A37E}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	46	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	4408	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	6edcf85b-37fc-4a62-bdc3-7a9d86d8a37e		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{6EDCF85B-37FC-4A62-BDC3-7A9D86D8A37E}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	45	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	4408	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	6edcf85b-37fc-4a62-bdc3-7a9d86d8a37e		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{6A345DE5-30E8-4681-87D0-75B77A32321A}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	44	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	6a345de5-30e8-4681-87d0-75b77a32321a		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{6A345DE5-30E8-4681-87D0-75B77A32321A}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	43	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	6a345de5-30e8-4681-87d0-75b77a32321a		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{6A345DE5-30E8-4681-87D0-75B77A32321A}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	42	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	3636	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	6a345de5-30e8-4681-87d0-75b77a32321a		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{6A345DE5-30E8-4681-87D0-75B77A32321A}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	41	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	3636	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	6a345de5-30e8-4681-87d0-75b77a32321a		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{7D89EC5C-CE15-4504-8E46-6F79F4838203}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	40	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	7d89ec5c-ce15-4504-8e46-6f79f4838203		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{7D89EC5C-CE15-4504-8E46-6F79F4838203}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	39	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	7d89ec5c-ce15-4504-8e46-6f79f4838203		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{2A527FE9-D79A-4963-8EA7-03E3DB9214E4}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	38	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	2a527fe9-d79a-4963-8ea7-03e3db9214e4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{2A527FE9-D79A-4963-8EA7-03E3DB9214E4}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	37	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	2a527fe9-d79a-4963-8ea7-03e3db9214e4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{2A527FE9-D79A-4963-8EA7-03E3DB9214E4}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	36	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	4408	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	2a527fe9-d79a-4963-8ea7-03e3db9214e4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{2A527FE9-D79A-4963-8EA7-03E3DB9214E4}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	35	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	4408	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	2a527fe9-d79a-4963-8ea7-03e3db9214e4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{443AEAAC-7ED9-4955-B250-D25A662B1BD6}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	34	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	443aeaac-7ed9-4955-b250-d25a662b1bd6		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{443AEAAC-7ED9-4955-B250-D25A662B1BD6}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	33	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	443aeaac-7ed9-4955-b250-d25a662b1bd6		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{443AEAAC-7ED9-4955-B250-D25A662B1BD6}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	32	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2744	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	443aeaac-7ed9-4955-b250-d25a662b1bd6		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{443AEAAC-7ED9-4955-B250-D25A662B1BD6}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	31	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2744	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	443aeaac-7ed9-4955-b250-d25a662b1bd6		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{D1B51B7C-5E8C-4AED-A51C-587E08B627E4}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	30	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	d1b51b7c-5e8c-4aed-a51c-587e08b627e4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{D1B51B7C-5E8C-4AED-A51C-587E08B627E4}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	29	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:08 PM	d1b51b7c-5e8c-4aed-a51c-587e08b627e4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{86181BB9-33E0-42E0-A482-47753041B6B0}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	28	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:07 PM	86181bb9-33e0-42e0-a482-47753041b6b0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{86181BB9-33E0-42E0-A482-47753041B6B0}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	27	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:07 PM	86181bb9-33e0-42e0-a482-47753041b6b0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{2A527FE9-D79A-4963-8EA7-03E3DB9214E4}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" and will launch it as soon as instance "{D1B51B7C-5E8C-4AED-A51C-587E08B627E4}" completes.	324	0		3	324	0	-9223372036854775808	26	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:07 PM	2a527fe9-d79a-4963-8ea7-03e3db9214e4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{B75D9A0E-4DDB-41AC-8B68-09760FB450DD}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{7D89EC5C-CE15-4504-8E46-6F79F4838203}" completes.	324	0		3	324	0	-9223372036854775808	25	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2804	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:07 PM	b75d9a0e-4ddb-41ac-8b68-09760fb450dd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{7ADA0697-C9B0-4221-BDA2-4E9AE67464BA}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1		4	200	1	-9223372036854775808	24	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:04 PM	7ada0697-c9b0-4221-bda2-4e9ae67464ba		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{7ADA0697-C9B0-4221-BDA2-4E9AE67464BA}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	23	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:04 PM	7ada0697-c9b0-4221-bda2-4e9ae67464ba		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 3700.	129	0		4	129	0	-9223372036854775808	22	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:04 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{00000000-0000-0000-0000-000000000000}" instance of task "\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents" according to an event trigger.	108	0		4	108	0	-9223372036854775808	21	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:51:04 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered on event	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{3244A965-F307-42E3-A75C-4ACE6E0836C9}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	20	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2816	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:55 PM	3244a965-f307-42e3-a75c-4ace6e0836c9		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{3244A965-F307-42E3-A75C-4ACE6E0836C9}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	19	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2816	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:55 PM	3244a965-f307-42e3-a75c-4ace6e0836c9		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{3244A965-F307-42E3-A75C-4ACE6E0836C9}" instance of task "\Microsoft\Windows\CertificateServicesClient\SystemTask" due to system startup.	118	0		4	118	0	-9223372036854775808	18	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2816	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:55 PM	3244a965-f307-42e3-a75c-4ace6e0836c9		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{5CCBB1CC-6CA7-4441-938A-3BEB46F208E3}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	17	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2816	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:54 PM	5ccbb1cc-6ca7-4441-938a-3beb46f208e3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{5CCBB1CC-6CA7-4441-938A-3BEB46F208E3}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	16	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2816	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:54 PM	5ccbb1cc-6ca7-4441-938a-3beb46f208e3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{443AEAAC-7ED9-4955-B250-D25A662B1BD6}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" and will launch it as soon as instance "{D1B51B7C-5E8C-4AED-A51C-587E08B627E4}" completes.	324	0		3	324	0	-9223372036854775808	15	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2604	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:49 PM	443aeaac-7ed9-4955-b250-d25a662b1bd6		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{6EDCF85B-37FC-4A62-BDC3-7A9D86D8A37E}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{7D89EC5C-CE15-4504-8E46-6F79F4838203}" completes.	324	0		3	324	0	-9223372036854775808	14	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2344	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:49 PM	6edcf85b-37fc-4a62-bdc3-7a9d86d8a37e		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{5CCBB1CC-6CA7-4441-938A-3BEB46F208E3}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	13	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2604	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:49 PM	5ccbb1cc-6ca7-4441-938a-3beb46f208e3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{5CCBB1CC-6CA7-4441-938A-3BEB46F208E3}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	12	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2604	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:49 PM	5ccbb1cc-6ca7-4441-938a-3beb46f208e3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{6A345DE5-30E8-4681-87D0-75B77A32321A}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{7D89EC5C-CE15-4504-8E46-6F79F4838203}" completes.	324	0		3	324	0	-9223372036854775808	11	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2400	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:48 PM	6a345de5-30e8-4681-87d0-75b77a32321a		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{D1B51B7C-5E8C-4AED-A51C-587E08B627E4}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	10	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:48 PM	d1b51b7c-5e8c-4aed-a51c-587e08b627e4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{D1B51B7C-5E8C-4AED-A51C-587E08B627E4}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	9	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:48 PM	d1b51b7c-5e8c-4aed-a51c-587e08b627e4		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{5E887156-22A9-4352-A858-ADD7A63AC95F}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	8	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:48 PM	5e887156-22a9-4352-a858-add7a63ac95f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{5E887156-22A9-4352-A858-ADD7A63AC95F}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	7	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:48 PM	5e887156-22a9-4352-a858-add7a63ac95f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\compattelrunner.exe" in instance "{769BEF4C-4CE4-4CBE-BA4B-EF185F826136}" of task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser".	200	1		4	200	1	-9223372036854775808	6	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:46 PM	769bef4c-4ce4-4cbe-ba4b-ef185f826136		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{769BEF4C-4CE4-4CBE-BA4B-EF185F826136}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	5	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:46 PM	769bef4c-4ce4-4cbe-ba4b-ef185f826136		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "%windir%\system32\compattelrunner.exe" with process ID 3132.	129	0		4	129	0	-9223372036854775808	4	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2144	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:46 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{7D89EC5C-CE15-4504-8E46-6F79F4838203}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	3	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2928	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:46 PM	7d89ec5c-ce15-4504-8e46-6f79f4838203		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{7D89EC5C-CE15-4504-8E46-6F79F4838203}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	2	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2928	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:46 PM	7d89ec5c-ce15-4504-8e46-6f79f4838203		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 3112.	129	0		4	129	0	-9223372036854775808	1	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1464	2928	n-h1-799684-4.cbci-799684-4.local	S-1-5-18	7/12/2021 2:50:46 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]