Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
User "CBCI-828599-3\N-H2-828599-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	103	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 12:45:18 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-828599-3\N-H2-828599-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	102	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	5016	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 12:15:18 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{FD12B491-40F7-4F10-AD33-9D679E51CC20}" instance of the "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	101	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2972	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 12:00:01 PM	fd12b491-40f7-4f10-ad33-9d679e51cc20		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" , instance "{FD12B491-40F7-4F10-AD33-9D679E51CC20}" , action "%SystemRoot%\System32\wsqmcons.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	100	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2972	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 12:00:01 PM	fd12b491-40f7-4f10-ad33-9d679e51cc20		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%SystemRoot%\System32\wsqmcons.exe" in instance "{FD12B491-40F7-4F10-AD33-9D679E51CC20}" of task "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator".	200	1		4	200	1	-9223372036854775808	99	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2972	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 12:00:01 PM	fd12b491-40f7-4f10-ad33-9d679e51cc20		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{FD12B491-40F7-4F10-AD33-9D679E51CC20}" instance of the "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	98	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2972	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 12:00:01 PM	fd12b491-40f7-4f10-ad33-9d679e51cc20		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" , instance "%SystemRoot%\System32\wsqmcons.exe" with process ID 4132.	129	0		4	129	0	-9223372036854775808	97	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2972	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 12:00:01 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{FD12B491-40F7-4F10-AD33-9D679E51CC20}" instance of task "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" due to a time trigger condition.	107	0		4	107	0	-9223372036854775808	96	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2972	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 12:00:01 PM	fd12b491-40f7-4f10-ad33-9d679e51cc20		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered on scheduler	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-828599-3\N-H2-828599-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	95	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2872	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 11:45:17 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{A4894285-D0B5-4A33-9147-C50C36402F92}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	94	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 11:24:46 AM	a4894285-d0b5-4a33-9147-c50c36402f92		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Autochk\Proxy" , instance "{A4894285-D0B5-4A33-9147-C50C36402F92}" , action "%windir%\system32\rundll32.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	93	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 11:24:46 AM	a4894285-d0b5-4a33-9147-c50c36402f92		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\rundll32.exe" in instance "{A4894285-D0B5-4A33-9147-C50C36402F92}" of task "\Microsoft\Windows\Autochk\Proxy".	200	1		4	200	1	-9223372036854775808	92	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 11:24:46 AM	a4894285-d0b5-4a33-9147-c50c36402f92		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{A4894285-D0B5-4A33-9147-C50C36402F92}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	91	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 11:24:46 AM	a4894285-d0b5-4a33-9147-c50c36402f92		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Autochk\Proxy" , instance "%windir%\system32\rundll32.exe" with process ID 5444.	129	0		4	129	0	-9223372036854775808	90	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 11:24:46 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{A4894285-D0B5-4A33-9147-C50C36402F92}" instance of task "\Microsoft\Windows\Autochk\Proxy" due to system startup.	118	0		4	118	0	-9223372036854775808	89	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 11:24:46 AM	a4894285-d0b5-4a33-9147-c50c36402f92		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-828599-3\N-H2-828599-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	88	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2972	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 11:15:17 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "NT AUTHORITY\SYSTEM" updated Task Scheduler task "\Microsoft\Windows\WindowsUpdate\Scheduled Start"	140	0		4	140	0	-9223372036854775808	87	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 11:05:44 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{B321A407-9B00-4AEC-8047-D9F947FDF38D}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	86	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:54:46 AM	b321a407-9b00-4aec-8047-d9f947fdf38d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "{B321A407-9B00-4AEC-8047-D9F947FDF38D}" , action "%windir%\System32\XblGameSaveTask.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	85	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:54:46 AM	b321a407-9b00-4aec-8047-d9f947fdf38d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\System32\XblGameSaveTask.exe" in instance "{B321A407-9B00-4AEC-8047-D9F947FDF38D}" of task "\Microsoft\XblGameSave\XblGameSaveTask".	200	1		4	200	1	-9223372036854775808	84	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:54:46 AM	b321a407-9b00-4aec-8047-d9f947fdf38d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{B321A407-9B00-4AEC-8047-D9F947FDF38D}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	83	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:54:46 AM	b321a407-9b00-4aec-8047-d9f947fdf38d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "%windir%\System32\XblGameSaveTask.exe" with process ID 3028.	129	0		4	129	0	-9223372036854775808	82	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:54:46 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" disabled Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	142	0		4	142	0	-9223372036854775808	81	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2976	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:51:51 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task disabled	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-828599-3\N-H2-828599-3$" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan"	140	0		4	140	0	-9223372036854775808	80	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1784	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:51:47 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{AB5F6068-97E2-4E62-82A7-761E5BB787BA}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	79	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2816	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:51:47 AM	ab5f6068-97e2-4e62-82a7-761e5bb787ba		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "{AB5F6068-97E2-4E62-82A7-761E5BB787BA}" , action "%systemroot%\system32\usoclient.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	78	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2816	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:51:47 AM	ab5f6068-97e2-4e62-82a7-761e5bb787ba		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	140	0		4	140	0	-9223372036854775808	77	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1784	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:51:47 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\usoclient.exe" in instance "{AB5F6068-97E2-4E62-82A7-761E5BB787BA}" of task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan".	200	1		4	200	1	-9223372036854775808	76	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1784	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:51:45 AM	ab5f6068-97e2-4e62-82a7-761e5bb787ba		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{AB5F6068-97E2-4E62-82A7-761E5BB787BA}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	75	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1784	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:51:45 AM	ab5f6068-97e2-4e62-82a7-761e5bb787ba		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "%systemroot%\system32\usoclient.exe" with process ID 3028.	129	0		4	129	0	-9223372036854775808	74	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1784	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:51:45 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler could not launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" as scheduled. Instance "{AB5F6068-97E2-4E62-82A7-761E5BB787BA}" is started now as required by the configuration option to start the task when available, if schedule is missed.	114	0		3	114	0	-9223372036854775808	73	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1784	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:51:45 AM	ab5f6068-97e2-4e62-82a7-761e5bb787ba		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Missed task started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{AE8398AE-2770-4CBB-AC55-D1B62D72DA69}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	72	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2872	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:47:46 AM	ae8398ae-2770-4cbb-ac55-d1b62d72da69		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{AE8398AE-2770-4CBB-AC55-D1B62D72DA69}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	71	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2872	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:47:46 AM	ae8398ae-2770-4cbb-ac55-d1b62d72da69		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{AE8398AE-2770-4CBB-AC55-D1B62D72DA69}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1		4	200	1	-9223372036854775808	70	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2872	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:47:46 AM	ae8398ae-2770-4cbb-ac55-d1b62d72da69		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{AE8398AE-2770-4CBB-AC55-D1B62D72DA69}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	69	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2872	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:47:46 AM	ae8398ae-2770-4cbb-ac55-d1b62d72da69		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 3264.	129	0		4	129	0	-9223372036854775808	68	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2872	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:47:46 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{AE8398AE-2770-4CBB-AC55-D1B62D72DA69}" instance of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" due to system startup.	118	0		4	118	0	-9223372036854775808	67	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2872	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:47:46 AM	ae8398ae-2770-4cbb-ac55-d1b62d72da69		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-828599-3\N-H2-828599-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	66	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2952	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:47:18 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{9846DF40-D216-4C90-A2AC-9255E458BAB0}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	65	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2976	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:46:35 AM	9846df40-d216-4c90-a2ac-9255e458bab0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "{9846DF40-D216-4C90-A2AC-9255E458BAB0}" , action "%windir%\system32\compattelrunner.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	64	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2976	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:46:35 AM	9846df40-d216-4c90-a2ac-9255e458bab0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{A332B8DE-001E-4D42-AC73-116AFDD8B3F1}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	63	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2972	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:48 AM	a332b8de-001e-4d42-ac73-116afdd8b3f1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "{A332B8DE-001E-4D42-AC73-116AFDD8B3F1}" , action "%systemroot%\system32\cmd.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	62	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2972	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:48 AM	a332b8de-001e-4d42-ac73-116afdd8b3f1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\cmd.exe" in instance "{A332B8DE-001E-4D42-AC73-116AFDD8B3F1}" of task "\Microsoft\Windows\Software Inventory Logging\Configuration".	200	1		4	200	1	-9223372036854775808	61	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2952	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:46 AM	a332b8de-001e-4d42-ac73-116afdd8b3f1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{A332B8DE-001E-4D42-AC73-116AFDD8B3F1}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	60	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2952	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:46 AM	a332b8de-001e-4d42-ac73-116afdd8b3f1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "%systemroot%\system32\cmd.exe" with process ID 4168.	129	0		4	129	0	-9223372036854775808	59	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2952	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:46 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{A332B8DE-001E-4D42-AC73-116AFDD8B3F1}" instance of task "\Microsoft\Windows\Software Inventory Logging\Configuration" due to system startup.	118	0		4	118	0	-9223372036854775808	58	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2952	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:46 AM	a332b8de-001e-4d42-ac73-116afdd8b3f1		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-828599-3\N-H2-828599-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	57	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:27 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{B4E4A7E4-98D2-4DE1-A342-B68F9EF00AD0}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	56	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM	b4e4a7e4-98d2-4de1-a342-b68f9ef00ad0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{B4E4A7E4-98D2-4DE1-A342-B68F9EF00AD0}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	55	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM	b4e4a7e4-98d2-4de1-a342-b68f9ef00ad0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{B4E4A7E4-98D2-4DE1-A342-B68F9EF00AD0}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	54	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM	b4e4a7e4-98d2-4de1-a342-b68f9ef00ad0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{B4E4A7E4-98D2-4DE1-A342-B68F9EF00AD0}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	53	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM	b4e4a7e4-98d2-4de1-a342-b68f9ef00ad0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 4940.	129	0		4	129	0	-9223372036854775808	52	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{E1515CD3-3A8E-4F5B-A3EE-886E051BDE84}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	51	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM	e1515cd3-3a8e-4f5b-a3ee-886e051bde84		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{E1515CD3-3A8E-4F5B-A3EE-886E051BDE84}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	50	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM	e1515cd3-3a8e-4f5b-a3ee-886e051bde84		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{1AA8F64D-3701-436D-9C3C-8D81E9815BC5}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	49	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM	1aa8f64d-3701-436d-9c3c-8d81e9815bc5		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{1AA8F64D-3701-436D-9C3C-8D81E9815BC5}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	48	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM	1aa8f64d-3701-436d-9c3c-8d81e9815bc5		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{1AA8F64D-3701-436D-9C3C-8D81E9815BC5}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	47	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM	1aa8f64d-3701-436d-9c3c-8d81e9815bc5		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{1AA8F64D-3701-436D-9C3C-8D81E9815BC5}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	46	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM	1aa8f64d-3701-436d-9c3c-8d81e9815bc5		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{E1515CD3-3A8E-4F5B-A3EE-886E051BDE84}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	45	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM	e1515cd3-3a8e-4f5b-a3ee-886e051bde84		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{E1515CD3-3A8E-4F5B-A3EE-886E051BDE84}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	44	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM	e1515cd3-3a8e-4f5b-a3ee-886e051bde84		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 4360.	129	0		4	129	0	-9223372036854775808	43	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:25 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{3BFE832B-9962-4830-9938-5BA834AEDC4C}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	42	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM	3bfe832b-9962-4830-9938-5ba834aedc4c		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{3BFE832B-9962-4830-9938-5BA834AEDC4C}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	41	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM	3bfe832b-9962-4830-9938-5ba834aedc4c		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{3BFE832B-9962-4830-9938-5BA834AEDC4C}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	40	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM	3bfe832b-9962-4830-9938-5ba834aedc4c		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{3BFE832B-9962-4830-9938-5BA834AEDC4C}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	39	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM	3bfe832b-9962-4830-9938-5ba834aedc4c		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 3940.	129	0		4	129	0	-9223372036854775808	38	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{0D94EB69-7198-4F16-85E0-3D115CF99F83}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	37	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM	0d94eb69-7198-4f16-85e0-3d115cf99f83		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{0D94EB69-7198-4F16-85E0-3D115CF99F83}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	36	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM	0d94eb69-7198-4f16-85e0-3d115cf99f83		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{0D94EB69-7198-4F16-85E0-3D115CF99F83}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	35	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM	0d94eb69-7198-4f16-85e0-3d115cf99f83		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{0D94EB69-7198-4F16-85E0-3D115CF99F83}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	34	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM	0d94eb69-7198-4f16-85e0-3d115cf99f83		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "taskhostw.exe" with process ID 3588.	129	0		4	129	0	-9223372036854775808	33	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2364	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{D59903FF-C5F9-4B7F-AE38-E8A867235B73}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	32	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM	d59903ff-c5f9-4b7f-ae38-e8a867235b73		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{D59903FF-C5F9-4B7F-AE38-E8A867235B73}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	31	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2876	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM	d59903ff-c5f9-4b7f-ae38-e8a867235b73		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{D59903FF-C5F9-4B7F-AE38-E8A867235B73}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	30	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2816	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM	d59903ff-c5f9-4b7f-ae38-e8a867235b73		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{D59903FF-C5F9-4B7F-AE38-E8A867235B73}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	29	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2816	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM	d59903ff-c5f9-4b7f-ae38-e8a867235b73		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 3976.	129	0		4	129	0	-9223372036854775808	28	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2816	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:45:16 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{85906B72-6EEB-4FAC-9D1E-B08B30C108F2}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	27	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:56 AM	85906b72-6eeb-4fac-9d1e-b08b30c108f2		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{85906B72-6EEB-4FAC-9D1E-B08B30C108F2}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	26	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:56 AM	85906b72-6eeb-4fac-9d1e-b08b30c108f2		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{85906B72-6EEB-4FAC-9D1E-B08B30C108F2}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	25	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:56 AM	85906b72-6eeb-4fac-9d1e-b08b30c108f2		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{85906B72-6EEB-4FAC-9D1E-B08B30C108F2}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	24	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:56 AM	85906b72-6eeb-4fac-9d1e-b08b30c108f2		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 3976.	129	0		4	129	0	-9223372036854775808	23	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:56 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{85906B72-6EEB-4FAC-9D1E-B08B30C108F2}" instance of task "\Microsoft\Windows\CertificateServicesClient\SystemTask" due to system startup.	118	0		4	118	0	-9223372036854775808	22	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:56 AM	85906b72-6eeb-4fac-9d1e-b08b30c108f2		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{D4908593-927F-4201-ADF9-ED9F8AB52D01}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	21	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:55 AM	d4908593-927f-4201-adf9-ed9f8ab52d01		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{D4908593-927F-4201-ADF9-ED9F8AB52D01}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	20	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:55 AM	d4908593-927f-4201-adf9-ed9f8ab52d01		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{CD8FC980-D713-44C2-BD36-A29D040EE266}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	19	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:55 AM	cd8fc980-d713-44c2-bd36-a29d040ee266		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{CD8FC980-D713-44C2-BD36-A29D040EE266}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	18	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:55 AM	cd8fc980-d713-44c2-bd36-a29d040ee266		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{CD8FC980-D713-44C2-BD36-A29D040EE266}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	17	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2268	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:55 AM	cd8fc980-d713-44c2-bd36-a29d040ee266		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{CD8FC980-D713-44C2-BD36-A29D040EE266}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	16	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2268	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:55 AM	cd8fc980-d713-44c2-bd36-a29d040ee266		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{923EC3D7-E113-4173-94D9-2F23FD240CD3}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	15	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:55 AM	923ec3d7-e113-4173-94d9-2f23fd240cd3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{923EC3D7-E113-4173-94D9-2F23FD240CD3}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	14	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:55 AM	923ec3d7-e113-4173-94d9-2f23fd240cd3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{9A63ABCB-8C07-4EEE-A111-5130C6B6D75D}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	13	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:55 AM	9a63abcb-8c07-4eee-a111-5130c6b6d75d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{9A63ABCB-8C07-4EEE-A111-5130C6B6D75D}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	12	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2312	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:55 AM	9a63abcb-8c07-4eee-a111-5130c6b6d75d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{CD8FC980-D713-44C2-BD36-A29D040EE266}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{923EC3D7-E113-4173-94D9-2F23FD240CD3}" completes.	324	0		3	324	0	-9223372036854775808	11	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2872	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:50 AM	cd8fc980-d713-44c2-bd36-a29d040ee266		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{9A63ABCB-8C07-4EEE-A111-5130C6B6D75D}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	10	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2976	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:50 AM	9a63abcb-8c07-4eee-a111-5130c6b6d75d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{9A63ABCB-8C07-4EEE-A111-5130C6B6D75D}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	9	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2976	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:50 AM	9a63abcb-8c07-4eee-a111-5130c6b6d75d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{D4908593-927F-4201-ADF9-ED9F8AB52D01}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	8	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2872	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:50 AM	d4908593-927f-4201-adf9-ed9f8ab52d01		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{D4908593-927F-4201-ADF9-ED9F8AB52D01}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	7	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2872	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:50 AM	d4908593-927f-4201-adf9-ed9f8ab52d01		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\compattelrunner.exe" in instance "{9846DF40-D216-4C90-A2AC-9255E458BAB0}" of task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser".	200	1		4	200	1	-9223372036854775808	6	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2976	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:47 AM	9846df40-d216-4c90-a2ac-9255e458bab0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{9846DF40-D216-4C90-A2AC-9255E458BAB0}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	5	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2976	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:47 AM	9846df40-d216-4c90-a2ac-9255e458bab0		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "%windir%\system32\compattelrunner.exe" with process ID 3084.	129	0		4	129	0	-9223372036854775808	4	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	2976	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:47 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{923EC3D7-E113-4173-94D9-2F23FD240CD3}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	3	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1784	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:47 AM	923ec3d7-e113-4173-94d9-2f23fd240cd3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{923EC3D7-E113-4173-94D9-2F23FD240CD3}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	2	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1784	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:47 AM	923ec3d7-e113-4173-94d9-2f23fd240cd3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 3052.	129	0		4	129	0	-9223372036854775808	1	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1436	1784	n-h2-828599-3.cbci-828599-3.local	S-1-5-18	3/23/2022 10:44:47 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]