Message	Id	Version	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
User "CBCI-816157-14\N-H2-816157-14$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	109	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2204	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:47:57 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-816157-14\N-H2-816157-14$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	108	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:17:57 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{280685E5-4B00-4377-A884-1E967851FDC6}" instance of the "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	107	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2880	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:00:01 AM	280685e5-4b00-4377-a884-1e967851fdc6	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" , instance "{280685E5-4B00-4377-A884-1E967851FDC6}" , action "%SystemRoot%\System32\wsqmcons.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	106	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2880	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:00:01 AM	280685e5-4b00-4377-a884-1e967851fdc6	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%SystemRoot%\System32\wsqmcons.exe" in instance "{280685E5-4B00-4377-A884-1E967851FDC6}" of task "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator".	200	1	4	200	1	-9223372036854775808	105	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2880	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:00:01 AM	280685e5-4b00-4377-a884-1e967851fdc6	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{280685E5-4B00-4377-A884-1E967851FDC6}" instance of the "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	104	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2880	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:00:01 AM	280685e5-4b00-4377-a884-1e967851fdc6	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" , instance "%SystemRoot%\System32\wsqmcons.exe" with process ID 4552.	129	0	4	129	0	-9223372036854775808	103	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2880	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:00:01 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{280685E5-4B00-4377-A884-1E967851FDC6}" instance of task "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" due to a time trigger condition.	107	0	4	107	0	-9223372036854775808	102	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2880	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:00:01 AM	280685e5-4b00-4377-a884-1e967851fdc6	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered on scheduler	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{CBE7F730-338A-4F2F-A9C5-533AD765E68D}" instance of the "\Microsoft\Windows\Speech\SpeechModelDownloadTask" task for user "NT AUTHORITY\NETWORK SERVICE".	102	0	4	102	2	-9223372036854775807	101	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2204	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:00:00 AM	cbe7f730-338a-4f2f-a9c5-533ad765e68d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Speech\SpeechModelDownloadTask" , instance "{CBE7F730-338A-4F2F-A9C5-533AD765E68D}" , action "%windir%\system32\speech_onecore\common\SpeechModelDownload.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	100	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2204	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:00:00 AM	cbe7f730-338a-4f2f-a9c5-533ad765e68d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\speech_onecore\common\SpeechModelDownload.exe" in instance "{CBE7F730-338A-4F2F-A9C5-533AD765E68D}" of task "\Microsoft\Windows\Speech\SpeechModelDownloadTask".	200	1	4	200	1	-9223372036854775808	99	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2880	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:00:00 AM	cbe7f730-338a-4f2f-a9c5-533ad765e68d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{CBE7F730-338A-4F2F-A9C5-533AD765E68D}" instance of the "\Microsoft\Windows\Speech\SpeechModelDownloadTask" task for user "NT AUTHORITY\NETWORK SERVICE".	100	0	4	100	1	-9223372036854775807	98	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2880	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:00:00 AM	cbe7f730-338a-4f2f-a9c5-533ad765e68d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Speech\SpeechModelDownloadTask" , instance "%windir%\system32\speech_onecore\common\SpeechModelDownload.exe" with process ID 4352.	129	0	4	129	0	-9223372036854775808	97	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2880	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:00:00 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{CBE7F730-338A-4F2F-A9C5-533AD765E68D}" instance of task "\Microsoft\Windows\Speech\SpeechModelDownloadTask" due to a time trigger condition.	107	0	4	107	0	-9223372036854775808	96	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2880	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/29/2022 12:00:00 AM	cbe7f730-338a-4f2f-a9c5-533ad765e68d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered on scheduler	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{5E5E77FA-56B6-49D4-95EE-F74E86049906}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	95	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:57:28 PM	5e5e77fa-56b6-49d4-95ee-f74e86049906	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Autochk\Proxy" , instance "{5E5E77FA-56B6-49D4-95EE-F74E86049906}" , action "%windir%\system32\rundll32.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	94	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:57:28 PM	5e5e77fa-56b6-49d4-95ee-f74e86049906	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\rundll32.exe" in instance "{5E5E77FA-56B6-49D4-95EE-F74E86049906}" of task "\Microsoft\Windows\Autochk\Proxy".	200	1	4	200	1	-9223372036854775808	93	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:57:26 PM	5e5e77fa-56b6-49d4-95ee-f74e86049906	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{5E5E77FA-56B6-49D4-95EE-F74E86049906}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	92	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:57:26 PM	5e5e77fa-56b6-49d4-95ee-f74e86049906	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Autochk\Proxy" , instance "%windir%\system32\rundll32.exe" with process ID 540.	129	0	4	129	0	-9223372036854775808	91	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:57:26 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{5E5E77FA-56B6-49D4-95EE-F74E86049906}" instance of task "\Microsoft\Windows\Autochk\Proxy" due to system startup.	118	0	4	118	0	-9223372036854775808	90	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:57:26 PM	5e5e77fa-56b6-49d4-95ee-f74e86049906	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-816157-14\N-H2-816157-14$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	89	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1800	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:47:57 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "NT AUTHORITY\SYSTEM" updated Task Scheduler task "\Microsoft\Windows\WindowsUpdate\Scheduled Start"	140	0	4	140	0	-9223372036854775808	88	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:39:56 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{444D4CAE-94E9-452E-9479-644EE7324D97}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	87	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1448	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:27:26 PM	444d4cae-94e9-452e-9479-644ee7324d97	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "{444D4CAE-94E9-452E-9479-644EE7324D97}" , action "%windir%\System32\XblGameSaveTask.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	86	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1448	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:27:26 PM	444d4cae-94e9-452e-9479-644ee7324d97	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\System32\XblGameSaveTask.exe" in instance "{444D4CAE-94E9-452E-9479-644EE7324D97}" of task "\Microsoft\XblGameSave\XblGameSaveTask".	200	1	4	200	1	-9223372036854775808	85	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1448	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:27:26 PM	444d4cae-94e9-452e-9479-644ee7324d97	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{444D4CAE-94E9-452E-9479-644EE7324D97}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	84	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1448	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:27:26 PM	444d4cae-94e9-452e-9479-644ee7324d97	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "%windir%\System32\XblGameSaveTask.exe" with process ID 5016.	129	0	4	129	0	-9223372036854775808	83	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1448	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:27:26 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" disabled Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	142	0	4	142	0	-9223372036854775808	82	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2248	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:21:27 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task disabled	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-816157-14\N-H2-816157-14$" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan"	140	0	4	140	0	-9223372036854775808	81	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2248	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:21:26 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{FCC5DB2B-0C3A-4DA8-9975-595B16C18826}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	80	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2248	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:21:26 PM	fcc5db2b-0c3a-4da8-9975-595b16c18826	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "{FCC5DB2B-0C3A-4DA8-9975-595B16C18826}" , action "%systemroot%\system32\usoclient.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	79	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2248	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:21:26 PM	fcc5db2b-0c3a-4da8-9975-595b16c18826	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	140	0	4	140	0	-9223372036854775808	78	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:21:26 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\usoclient.exe" in instance "{FCC5DB2B-0C3A-4DA8-9975-595B16C18826}" of task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan".	200	1	4	200	1	-9223372036854775808	77	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:21:25 PM	fcc5db2b-0c3a-4da8-9975-595b16c18826	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{FCC5DB2B-0C3A-4DA8-9975-595B16C18826}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	76	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:21:25 PM	fcc5db2b-0c3a-4da8-9975-595b16c18826	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "%systemroot%\system32\usoclient.exe" with process ID 5072.	129	0	4	129	0	-9223372036854775808	75	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:21:25 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler could not launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" as scheduled. Instance "{FCC5DB2B-0C3A-4DA8-9975-595B16C18826}" is started now as required by the configuration option to start the task when available, if schedule is missed.	114	0	3	114	0	-9223372036854775808	74	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:21:25 PM	fcc5db2b-0c3a-4da8-9975-595b16c18826	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Missed task started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{35C8DB20-CA2F-432C-BC1B-1D4F480FE8A4}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	73	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2872	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:20:26 PM	35c8db20-ca2f-432c-bc1b-1d4f480fe8a4	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{35C8DB20-CA2F-432C-BC1B-1D4F480FE8A4}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	72	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2872	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:20:26 PM	35c8db20-ca2f-432c-bc1b-1d4f480fe8a4	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{35C8DB20-CA2F-432C-BC1B-1D4F480FE8A4}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1	4	200	1	-9223372036854775808	71	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2872	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:20:26 PM	35c8db20-ca2f-432c-bc1b-1d4f480fe8a4	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{35C8DB20-CA2F-432C-BC1B-1D4F480FE8A4}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	70	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2872	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:20:26 PM	35c8db20-ca2f-432c-bc1b-1d4f480fe8a4	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 3472.	129	0	4	129	0	-9223372036854775808	69	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2872	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:20:26 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{35C8DB20-CA2F-432C-BC1B-1D4F480FE8A4}" instance of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" due to system startup.	118	0	4	118	0	-9223372036854775808	68	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2872	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:20:26 PM	35c8db20-ca2f-432c-bc1b-1d4f480fe8a4	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-816157-14\N-H2-816157-14$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	67	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:19:58 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{CC51F1D0-FDBC-4958-A431-51F95398D92B}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	66	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:19:15 PM	cc51f1d0-fdbc-4958-a431-51f95398d92b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "{CC51F1D0-FDBC-4958-A431-51F95398D92B}" , action "%windir%\system32\compattelrunner.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	65	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:19:15 PM	cc51f1d0-fdbc-4958-a431-51f95398d92b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{4E131DD0-526B-4BFC-A344-54532A0831CB}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	64	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1736	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:30 PM	4e131dd0-526b-4bfc-a344-54532a0831cb	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "{4E131DD0-526B-4BFC-A344-54532A0831CB}" , action "%systemroot%\system32\cmd.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	63	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1736	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:30 PM	4e131dd0-526b-4bfc-a344-54532a0831cb	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\cmd.exe" in instance "{4E131DD0-526B-4BFC-A344-54532A0831CB}" of task "\Microsoft\Windows\Software Inventory Logging\Configuration".	200	1	4	200	1	-9223372036854775808	62	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1736	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:26 PM	4e131dd0-526b-4bfc-a344-54532a0831cb	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{4E131DD0-526B-4BFC-A344-54532A0831CB}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	61	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1736	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:26 PM	4e131dd0-526b-4bfc-a344-54532a0831cb	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "%systemroot%\system32\cmd.exe" with process ID 3560.	129	0	4	129	0	-9223372036854775808	60	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1736	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:26 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{4E131DD0-526B-4BFC-A344-54532A0831CB}" instance of task "\Microsoft\Windows\Software Inventory Logging\Configuration" due to system startup.	118	0	4	118	0	-9223372036854775808	59	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1736	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:26 PM	4e131dd0-526b-4bfc-a344-54532a0831cb	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-816157-14\N-H2-816157-14$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	58	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2592	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:12 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{EF6FC7B6-1A7A-4718-9D46-D7E628647F9A}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	57	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2592	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM	ef6fc7b6-1a7a-4718-9d46-d7e628647f9a	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{EF6FC7B6-1A7A-4718-9D46-D7E628647F9A}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	56	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2592	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM	ef6fc7b6-1a7a-4718-9d46-d7e628647f9a	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{EF6FC7B6-1A7A-4718-9D46-D7E628647F9A}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1	4	200	1	-9223372036854775808	55	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2592	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM	ef6fc7b6-1a7a-4718-9d46-d7e628647f9a	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{EF6FC7B6-1A7A-4718-9D46-D7E628647F9A}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	54	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2592	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM	ef6fc7b6-1a7a-4718-9d46-d7e628647f9a	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "taskhostw.exe" with process ID 3780.	129	0	4	129	0	-9223372036854775808	53	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2592	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{30A84576-5CE0-43BC-881E-C09650A10A2A}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	52	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2868	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM	30a84576-5ce0-43bc-881e-c09650a10a2a	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{30A84576-5CE0-43BC-881E-C09650A10A2A}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	51	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2868	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM	30a84576-5ce0-43bc-881e-c09650a10a2a	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{30A84576-5CE0-43BC-881E-C09650A10A2A}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	50	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2868	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM	30a84576-5ce0-43bc-881e-c09650a10a2a	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{30A84576-5CE0-43BC-881E-C09650A10A2A}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	49	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2868	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM	30a84576-5ce0-43bc-881e-c09650a10a2a	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 4244.	129	0	4	129	0	-9223372036854775808	48	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2868	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{A1410C31-6DBA-48F8-90A2-7193C0B5CBB1}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	47	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM	a1410c31-6dba-48f8-90a2-7193c0b5cbb1	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{A1410C31-6DBA-48F8-90A2-7193C0B5CBB1}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	46	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM	a1410c31-6dba-48f8-90a2-7193c0b5cbb1	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{A1410C31-6DBA-48F8-90A2-7193C0B5CBB1}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	45	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM	a1410c31-6dba-48f8-90a2-7193c0b5cbb1	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{A1410C31-6DBA-48F8-90A2-7193C0B5CBB1}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	44	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM	a1410c31-6dba-48f8-90a2-7193c0b5cbb1	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 3668.	129	0	4	129	0	-9223372036854775808	43	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:18:05 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{5E37DC92-D937-4751-87E8-132470614431}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	42	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM	5e37dc92-d937-4751-87e8-132470614431	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{5E37DC92-D937-4751-87E8-132470614431}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	41	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM	5e37dc92-d937-4751-87e8-132470614431	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{5E37DC92-D937-4751-87E8-132470614431}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	40	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM	5e37dc92-d937-4751-87e8-132470614431	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{5E37DC92-D937-4751-87E8-132470614431}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	39	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM	5e37dc92-d937-4751-87e8-132470614431	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 4812.	129	0	4	129	0	-9223372036854775808	38	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{FAA74FA9-8224-4773-A93E-DAC76591FEC9}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	37	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM	faa74fa9-8224-4773-a93e-dac76591fec9	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{FAA74FA9-8224-4773-A93E-DAC76591FEC9}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	36	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM	faa74fa9-8224-4773-a93e-dac76591fec9	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{FAA74FA9-8224-4773-A93E-DAC76591FEC9}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1	4	200	1	-9223372036854775808	35	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM	faa74fa9-8224-4773-a93e-dac76591fec9	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{FAA74FA9-8224-4773-A93E-DAC76591FEC9}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	34	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM	faa74fa9-8224-4773-a93e-dac76591fec9	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "taskhostw.exe" with process ID 4784.	129	0	4	129	0	-9223372036854775808	33	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{8F4DE956-677C-4D42-BDB2-C1A3F7F314DE}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	32	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2868	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM	8f4de956-677c-4d42-bdb2-c1a3f7f314de	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{8F4DE956-677C-4D42-BDB2-C1A3F7F314DE}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	31	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2868	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM	8f4de956-677c-4d42-bdb2-c1a3f7f314de	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{8F4DE956-677C-4D42-BDB2-C1A3F7F314DE}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	30	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2868	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM	8f4de956-677c-4d42-bdb2-c1a3f7f314de	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{8F4DE956-677C-4D42-BDB2-C1A3F7F314DE}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	29	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2868	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM	8f4de956-677c-4d42-bdb2-c1a3f7f314de	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 4728.	129	0	4	129	0	-9223372036854775808	28	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2868	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:56 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{EA3E0E80-0FEE-4AAA-8AAA-F817DDC8DC1F}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	27	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:36 PM	ea3e0e80-0fee-4aaa-8aaa-f817ddc8dc1f	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{EA3E0E80-0FEE-4AAA-8AAA-F817DDC8DC1F}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	26	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:36 PM	ea3e0e80-0fee-4aaa-8aaa-f817ddc8dc1f	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{EA3E0E80-0FEE-4AAA-8AAA-F817DDC8DC1F}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	25	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:36 PM	ea3e0e80-0fee-4aaa-8aaa-f817ddc8dc1f	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{EA3E0E80-0FEE-4AAA-8AAA-F817DDC8DC1F}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	24	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:36 PM	ea3e0e80-0fee-4aaa-8aaa-f817ddc8dc1f	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 3848.	129	0	4	129	0	-9223372036854775808	23	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:36 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{EA3E0E80-0FEE-4AAA-8AAA-F817DDC8DC1F}" instance of task "\Microsoft\Windows\CertificateServicesClient\SystemTask" due to system startup.	118	0	4	118	0	-9223372036854775808	22	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:36 PM	ea3e0e80-0fee-4aaa-8aaa-f817ddc8dc1f	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{2D2C37F8-4AB4-4DC4-AFA1-0AF9A4163A75}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	21	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:35 PM	2d2c37f8-4ab4-4dc4-afa1-0af9a4163a75	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{2D2C37F8-4AB4-4DC4-AFA1-0AF9A4163A75}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	20	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:35 PM	2d2c37f8-4ab4-4dc4-afa1-0af9a4163a75	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{8123CF34-3BDE-435B-8DB8-C8C9380DD99B}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	19	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:35 PM	8123cf34-3bde-435b-8db8-c8c9380dd99b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{8123CF34-3BDE-435B-8DB8-C8C9380DD99B}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	18	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:35 PM	8123cf34-3bde-435b-8db8-c8c9380dd99b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{8123CF34-3BDE-435B-8DB8-C8C9380DD99B}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	17	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	3556	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:35 PM	8123cf34-3bde-435b-8db8-c8c9380dd99b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{8123CF34-3BDE-435B-8DB8-C8C9380DD99B}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	16	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	3556	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:35 PM	8123cf34-3bde-435b-8db8-c8c9380dd99b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{003040AF-278D-4B0E-804A-C5B904A411A9}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	15	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:35 PM	003040af-278d-4b0e-804a-c5b904a411a9	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{003040AF-278D-4B0E-804A-C5B904A411A9}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	14	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:35 PM	003040af-278d-4b0e-804a-c5b904a411a9	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{377A0396-A930-4DE9-996F-818B9E0E5325}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	13	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:35 PM	377a0396-a930-4de9-996f-818b9e0e5325	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{377A0396-A930-4DE9-996F-818B9E0E5325}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	12	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:35 PM	377a0396-a930-4de9-996f-818b9e0e5325	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{8123CF34-3BDE-435B-8DB8-C8C9380DD99B}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{003040AF-278D-4B0E-804A-C5B904A411A9}" completes.	324	0	3	324	0	-9223372036854775808	11	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2876	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:30 PM	8123cf34-3bde-435b-8db8-c8c9380dd99b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{2D2C37F8-4AB4-4DC4-AFA1-0AF9A4163A75}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	10	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:30 PM	2d2c37f8-4ab4-4dc4-afa1-0af9a4163a75	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{2D2C37F8-4AB4-4DC4-AFA1-0AF9A4163A75}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	9	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2260	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:30 PM	2d2c37f8-4ab4-4dc4-afa1-0af9a4163a75	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{377A0396-A930-4DE9-996F-818B9E0E5325}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1	4	200	1	-9223372036854775808	8	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2592	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:30 PM	377a0396-a930-4de9-996f-818b9e0e5325	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{377A0396-A930-4DE9-996F-818B9E0E5325}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	7	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	2592	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:30 PM	377a0396-a930-4de9-996f-818b9e0e5325	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\compattelrunner.exe" in instance "{CC51F1D0-FDBC-4958-A431-51F95398D92B}" of task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser".	200	1	4	200	1	-9223372036854775808	6	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1800	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:27 PM	cc51f1d0-fdbc-4958-a431-51f95398d92b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{CC51F1D0-FDBC-4958-A431-51F95398D92B}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	5	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1800	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:27 PM	cc51f1d0-fdbc-4958-a431-51f95398d92b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "%windir%\system32\compattelrunner.exe" with process ID 2732.	129	0	4	129	0	-9223372036854775808	4	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1800	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:27 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{003040AF-278D-4B0E-804A-C5B904A411A9}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	3	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1800	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:27 PM	003040af-278d-4b0e-804a-c5b904a411a9	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{003040AF-278D-4B0E-804A-C5B904A411A9}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	2	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1800	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:27 PM	003040af-278d-4b0e-804a-c5b904a411a9	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 2844.	129	0	4	129	0	-9223372036854775808	1	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1380	1800	n-h2-816157-14.cbci-816157-14.local	S-1-5-18	8/28/2022 11:17:27 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]