Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
User "CBCI-829049-1\N-H1-829049-1$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	125	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	3976	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 4:31:42 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-829049-1\N-H1-829049-1$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	124	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 4:01:41 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{DB83EBC3-0306-4568-A779-FDF506145B31}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	123	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:41:11 AM	db83ebc3-0306-4568-a779-fdf506145b31		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Autochk\Proxy" , instance "{DB83EBC3-0306-4568-A779-FDF506145B31}" , action "%windir%\system32\rundll32.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	122	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:41:11 AM	db83ebc3-0306-4568-a779-fdf506145b31		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\rundll32.exe" in instance "{DB83EBC3-0306-4568-A779-FDF506145B31}" of task "\Microsoft\Windows\Autochk\Proxy".	200	1		4	200	1	-9223372036854775808	121	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1956	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:41:11 AM	db83ebc3-0306-4568-a779-fdf506145b31		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{DB83EBC3-0306-4568-A779-FDF506145B31}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	120	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1956	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:41:11 AM	db83ebc3-0306-4568-a779-fdf506145b31		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Autochk\Proxy" , instance "%windir%\system32\rundll32.exe" with process ID 4176.	129	0		4	129	0	-9223372036854775808	119	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1956	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:41:11 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{DB83EBC3-0306-4568-A779-FDF506145B31}" instance of task "\Microsoft\Windows\Autochk\Proxy" due to system startup.	118	0		4	118	0	-9223372036854775808	118	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1956	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:41:11 AM	db83ebc3-0306-4568-a779-fdf506145b31		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-829049-1\N-H1-829049-1$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	117	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:31:41 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "NT AUTHORITY\SYSTEM" updated Task Scheduler task "\Microsoft\Windows\WindowsUpdate\Scheduled Start"	140	0		4	140	0	-9223372036854775808	116	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2988	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:24:17 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{DEBC08A4-8108-4779-9E2E-B7745F0B19F9}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	115	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:11:11 AM	debc08a4-8108-4779-9e2e-b7745f0b19f9		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "{DEBC08A4-8108-4779-9E2E-B7745F0B19F9}" , action "%windir%\System32\XblGameSaveTask.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	114	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:11:11 AM	debc08a4-8108-4779-9e2e-b7745f0b19f9		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\System32\XblGameSaveTask.exe" in instance "{DEBC08A4-8108-4779-9E2E-B7745F0B19F9}" of task "\Microsoft\XblGameSave\XblGameSaveTask".	200	1		4	200	1	-9223372036854775808	113	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:11:11 AM	debc08a4-8108-4779-9e2e-b7745f0b19f9		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{DEBC08A4-8108-4779-9E2E-B7745F0B19F9}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	112	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:11:11 AM	debc08a4-8108-4779-9e2e-b7745f0b19f9		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "%windir%\System32\XblGameSaveTask.exe" with process ID 4524.	129	0		4	129	0	-9223372036854775808	111	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:11:11 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-829049-1\N-H1-829049-1$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	110	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2816	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:42 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{E6FB77C7-6276-4611-A691-CF9270E4EF33}" instance of the "\Microsoft\Windows\Device Information\Device" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	109	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2856	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:13 AM	e6fb77c7-6276-4611-a691-cf9270e4ef33		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Device Information\Device" , instance "{E6FB77C7-6276-4611-A691-CF9270E4EF33}" , action "%windir%\system32\devicecensus.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	108	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2856	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:13 AM	e6fb77c7-6276-4611-a691-cf9270e4ef33		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-829049-1\N-H1-829049-1$" updated Task Scheduler task "\Microsoft\Windows\Device Information\Device"	140	0		4	140	0	-9223372036854775808	107	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2856	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:13 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" disabled Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	142	0		4	142	0	-9223372036854775808	106	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1512	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:12 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task disabled	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{0751CE75-282A-42E6-837D-0301AB3C52E5}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	105	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1512	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:11 AM	0751ce75-282a-42e6-837d-0301ab3c52e5		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{0751CE75-282A-42E6-837D-0301AB3C52E5}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	104	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1512	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:11 AM	0751ce75-282a-42e6-837d-0301ab3c52e5		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-829049-1\N-H1-829049-1$" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan"	140	0		4	140	0	-9223372036854775808	103	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1512	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:11 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{98358F0C-F59B-4AD5-81B5-267DF15AEC26}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	102	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:11 AM	98358f0c-f59b-4ad5-81b5-267df15aec26		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "{98358F0C-F59B-4AD5-81B5-267DF15AEC26}" , action "%systemroot%\system32\usoclient.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	101	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:11 AM	98358f0c-f59b-4ad5-81b5-267df15aec26		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	140	0		4	140	0	-9223372036854775808	100	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1512	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:11 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{0751CE75-282A-42E6-837D-0301AB3C52E5}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1		4	200	1	-9223372036854775808	99	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:11 AM	0751ce75-282a-42e6-837d-0301ab3c52e5		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{0751CE75-282A-42E6-837D-0301AB3C52E5}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	98	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:11 AM	0751ce75-282a-42e6-837d-0301ab3c52e5		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 4752.	129	0		4	129	0	-9223372036854775808	97	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:11 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{0751CE75-282A-42E6-837D-0301AB3C52E5}" instance of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" due to system startup.	118	0		4	118	0	-9223372036854775808	96	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:11 AM	0751ce75-282a-42e6-837d-0301ab3c52e5		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{257A2918-7053-449F-A1C1-F829FE1E536B}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	95	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2856	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM	257a2918-7053-449f-a1c1-f829fe1e536b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "{257A2918-7053-449F-A1C1-F829FE1E536B}" , action "%windir%\system32\compattelrunner.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	94	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2856	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM	257a2918-7053-449f-a1c1-f829fe1e536b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\usoclient.exe" in instance "{98358F0C-F59B-4AD5-81B5-267DF15AEC26}" of task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan".	200	1		4	200	1	-9223372036854775808	93	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2856	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM	98358f0c-f59b-4ad5-81b5-267df15aec26		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{98358F0C-F59B-4AD5-81B5-267DF15AEC26}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	92	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2856	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM	98358f0c-f59b-4ad5-81b5-267df15aec26		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "%systemroot%\system32\usoclient.exe" with process ID 3132.	129	0		4	129	0	-9223372036854775808	91	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2856	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\devicecensus.exe" in instance "{E6FB77C7-6276-4611-A691-CF9270E4EF33}" of task "\Microsoft\Windows\Device Information\Device".	200	1		4	200	1	-9223372036854775808	90	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2924	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM	e6fb77c7-6276-4611-a691-cf9270e4ef33		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{E6FB77C7-6276-4611-A691-CF9270E4EF33}" instance of the "\Microsoft\Windows\Device Information\Device" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	89	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2924	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM	e6fb77c7-6276-4611-a691-cf9270e4ef33		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Device Information\Device" , instance "%windir%\system32\devicecensus.exe" with process ID 3288.	129	0		4	129	0	-9223372036854775808	88	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2924	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\compattelrunner.exe" in instance "{257A2918-7053-449F-A1C1-F829FE1E536B}" of task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser".	200	1		4	200	1	-9223372036854775808	87	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1512	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM	257a2918-7053-449f-a1c1-f829fe1e536b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{257A2918-7053-449F-A1C1-F829FE1E536B}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	86	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1512	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM	257a2918-7053-449f-a1c1-f829fe1e536b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "%windir%\system32\compattelrunner.exe" with process ID 992.	129	0		4	129	0	-9223372036854775808	85	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1512	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler could not launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" as scheduled. Instance "{98358F0C-F59B-4AD5-81B5-267DF15AEC26}" is started now as required by the configuration option to start the task when available, if schedule is missed.	114	0		3	114	0	-9223372036854775808	84	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2856	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM	98358f0c-f59b-4ad5-81b5-267df15aec26		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Missed task started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler could not launch task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" as scheduled. Instance "{257A2918-7053-449F-A1C1-F829FE1E536B}" is started now as required by the configuration option to start the task when available, if schedule is missed.	114	0		3	114	0	-9223372036854775808	83	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1512	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM	257a2918-7053-449f-a1c1-f829fe1e536b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Missed task started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler could not launch task "\Microsoft\Windows\Device Information\Device" as scheduled. Instance "{E6FB77C7-6276-4611-A691-CF9270E4EF33}" is started now as required by the configuration option to start the task when available, if schedule is missed.	114	0		3	114	0	-9223372036854775808	82	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2924	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:04:10 AM	e6fb77c7-6276-4611-a691-cf9270e4ef33		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Missed task started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-829049-1\N-H1-829049-1$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	81	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2816	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:03:42 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{6426B075-EB52-4282-A7EC-869A637F944F}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	80	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1512	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:02:59 AM	6426b075-eb52-4282-a7ec-869a637f944f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "{6426B075-EB52-4282-A7EC-869A637F944F}" , action "%windir%\system32\compattelrunner.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	79	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1512	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:02:59 AM	6426b075-eb52-4282-a7ec-869a637f944f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{E9A303B3-4A91-4A15-9D00-A8B5EA02D6FA}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	78	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:02:13 AM	e9a303b3-4a91-4a15-9d00-a8b5ea02d6fa		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "{E9A303B3-4A91-4A15-9D00-A8B5EA02D6FA}" , action "%systemroot%\system32\cmd.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	77	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:02:13 AM	e9a303b3-4a91-4a15-9d00-a8b5ea02d6fa		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\cmd.exe" in instance "{E9A303B3-4A91-4A15-9D00-A8B5EA02D6FA}" of task "\Microsoft\Windows\Software Inventory Logging\Configuration".	200	1		4	200	1	-9223372036854775808	76	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:02:11 AM	e9a303b3-4a91-4a15-9d00-a8b5ea02d6fa		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{E9A303B3-4A91-4A15-9D00-A8B5EA02D6FA}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	75	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:02:11 AM	e9a303b3-4a91-4a15-9d00-a8b5ea02d6fa		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "%systemroot%\system32\cmd.exe" with process ID 5060.	129	0		4	129	0	-9223372036854775808	74	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:02:11 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{E9A303B3-4A91-4A15-9D00-A8B5EA02D6FA}" instance of task "\Microsoft\Windows\Software Inventory Logging\Configuration" due to system startup.	118	0		4	118	0	-9223372036854775808	73	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:02:11 AM	e9a303b3-4a91-4a15-9d00-a8b5ea02d6fa		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-829049-1\N-H1-829049-1$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	72	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:57 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{36F7346B-DA6D-404D-AC7C-C244800EAFDD}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	71	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM	36f7346b-da6d-404d-ac7c-c244800eafdd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{36F7346B-DA6D-404D-AC7C-C244800EAFDD}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	70	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM	36f7346b-da6d-404d-ac7c-c244800eafdd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{36F7346B-DA6D-404D-AC7C-C244800EAFDD}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	69	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM	36f7346b-da6d-404d-ac7c-c244800eafdd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{36F7346B-DA6D-404D-AC7C-C244800EAFDD}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	68	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM	36f7346b-da6d-404d-ac7c-c244800eafdd		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 3984.	129	0		4	129	0	-9223372036854775808	67	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{F8B8214A-70B7-4FF9-85E1-7EF0A6F8EE11}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	66	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM	f8b8214a-70b7-4ff9-85e1-7ef0a6f8ee11		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{F8B8214A-70B7-4FF9-85E1-7EF0A6F8EE11}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	65	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM	f8b8214a-70b7-4ff9-85e1-7ef0a6f8ee11		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{F8B8214A-70B7-4FF9-85E1-7EF0A6F8EE11}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	64	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM	f8b8214a-70b7-4ff9-85e1-7ef0a6f8ee11		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{F8B8214A-70B7-4FF9-85E1-7EF0A6F8EE11}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	63	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM	f8b8214a-70b7-4ff9-85e1-7ef0a6f8ee11		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "taskhostw.exe" with process ID 4556.	129	0		4	129	0	-9223372036854775808	62	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{4716DFDA-F4EF-4C45-A8F4-DD89E67D62C8}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	61	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM	4716dfda-f4ef-4c45-a8f4-dd89e67d62c8		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{4716DFDA-F4EF-4C45-A8F4-DD89E67D62C8}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	60	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM	4716dfda-f4ef-4c45-a8f4-dd89e67d62c8		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{4716DFDA-F4EF-4C45-A8F4-DD89E67D62C8}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	59	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM	4716dfda-f4ef-4c45-a8f4-dd89e67d62c8		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{4716DFDA-F4EF-4C45-A8F4-DD89E67D62C8}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	58	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM	4716dfda-f4ef-4c45-a8f4-dd89e67d62c8		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 3480.	129	0		4	129	0	-9223372036854775808	57	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:50 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{A20E467D-D8EC-4857-ADBD-76B5284CC98A}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	56	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM	a20e467d-d8ec-4857-adbd-76b5284cc98a		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{A20E467D-D8EC-4857-ADBD-76B5284CC98A}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	55	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM	a20e467d-d8ec-4857-adbd-76b5284cc98a		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{A20E467D-D8EC-4857-ADBD-76B5284CC98A}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	54	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM	a20e467d-d8ec-4857-adbd-76b5284cc98a		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{A20E467D-D8EC-4857-ADBD-76B5284CC98A}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	53	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM	a20e467d-d8ec-4857-adbd-76b5284cc98a		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "taskhostw.exe" with process ID 4892.	129	0		4	129	0	-9223372036854775808	52	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{1B563006-35C2-4332-B5CC-6C16969D588D}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	51	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM	1b563006-35c2-4332-b5cc-6c16969d588d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{1B563006-35C2-4332-B5CC-6C16969D588D}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	50	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM	1b563006-35c2-4332-b5cc-6c16969d588d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{1B563006-35C2-4332-B5CC-6C16969D588D}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	49	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM	1b563006-35c2-4332-b5cc-6c16969d588d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{1B563006-35C2-4332-B5CC-6C16969D588D}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	48	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM	1b563006-35c2-4332-b5cc-6c16969d588d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 4864.	129	0		4	129	0	-9223372036854775808	47	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{BB708FED-EDB2-47A9-A166-688E19F10B30}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	46	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM	bb708fed-edb2-47a9-a166-688e19f10b30		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{BB708FED-EDB2-47A9-A166-688E19F10B30}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	45	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM	bb708fed-edb2-47a9-a166-688e19f10b30		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{BB708FED-EDB2-47A9-A166-688E19F10B30}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	44	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM	bb708fed-edb2-47a9-a166-688e19f10b30		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{BB708FED-EDB2-47A9-A166-688E19F10B30}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	43	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM	bb708fed-edb2-47a9-a166-688e19f10b30		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 4808.	129	0		4	129	0	-9223372036854775808	42	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:39 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{8F48CD48-C98B-4C45-969E-9F9C60CD8112}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	41	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:21 AM	8f48cd48-c98b-4c45-969e-9f9c60cd8112		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{8F48CD48-C98B-4C45-969E-9F9C60CD8112}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	40	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:21 AM	8f48cd48-c98b-4c45-969e-9f9c60cd8112		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{8F48CD48-C98B-4C45-969E-9F9C60CD8112}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	39	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:21 AM	8f48cd48-c98b-4c45-969e-9f9c60cd8112		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{8F48CD48-C98B-4C45-969E-9F9C60CD8112}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	38	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:21 AM	8f48cd48-c98b-4c45-969e-9f9c60cd8112		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 3948.	129	0		4	129	0	-9223372036854775808	37	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:21 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{8F48CD48-C98B-4C45-969E-9F9C60CD8112}" instance of task "\Microsoft\Windows\CertificateServicesClient\SystemTask" due to system startup.	118	0		4	118	0	-9223372036854775808	36	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:21 AM	8f48cd48-c98b-4c45-969e-9f9c60cd8112		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{7CBEB82A-0DAD-48E5-AEA9-55E85C82BEDF}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	35	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	7cbeb82a-0dad-48e5-aea9-55e85c82bedf		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{7CBEB82A-0DAD-48E5-AEA9-55E85C82BEDF}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	34	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	7cbeb82a-0dad-48e5-aea9-55e85c82bedf		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{043EE715-21ED-422B-BC21-0A421167B7FB}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	33	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	043ee715-21ed-422b-bc21-0a421167b7fb		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{043EE715-21ED-422B-BC21-0A421167B7FB}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	32	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	043ee715-21ed-422b-bc21-0a421167b7fb		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{043EE715-21ED-422B-BC21-0A421167B7FB}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	31	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	3724	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	043ee715-21ed-422b-bc21-0a421167b7fb		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{043EE715-21ED-422B-BC21-0A421167B7FB}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	30	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	3724	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	043ee715-21ed-422b-bc21-0a421167b7fb		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{2E77656F-AFCD-4642-A8EE-5EEA14F1D8AA}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	29	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	2e77656f-afcd-4642-a8ee-5eea14f1d8aa		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{2E77656F-AFCD-4642-A8EE-5EEA14F1D8AA}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	28	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	2e77656f-afcd-4642-a8ee-5eea14f1d8aa		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{2E77656F-AFCD-4642-A8EE-5EEA14F1D8AA}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	27	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	3724	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	2e77656f-afcd-4642-a8ee-5eea14f1d8aa		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{2E77656F-AFCD-4642-A8EE-5EEA14F1D8AA}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	26	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	3724	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	2e77656f-afcd-4642-a8ee-5eea14f1d8aa		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{4A2D383E-01B1-420A-A4EF-4F71391CDE3B}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	25	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	4a2d383e-01b1-420a-a4ef-4f71391cde3b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{4A2D383E-01B1-420A-A4EF-4F71391CDE3B}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	24	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	4a2d383e-01b1-420a-a4ef-4f71391cde3b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{462668AB-57BD-44E0-B913-E8C7768B6179}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	23	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	462668ab-57bd-44e0-b913-e8c7768b6179		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{462668AB-57BD-44E0-B913-E8C7768B6179}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	22	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2364	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	462668ab-57bd-44e0-b913-e8c7768b6179		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{462668AB-57BD-44E0-B913-E8C7768B6179}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	21	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2384	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	462668ab-57bd-44e0-b913-e8c7768b6179		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{462668AB-57BD-44E0-B913-E8C7768B6179}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	20	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2384	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	462668ab-57bd-44e0-b913-e8c7768b6179		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{164E0A2F-80E2-43B2-AB3A-DDC4417FD243}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	19	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	164e0a2f-80e2-43b2-ab3a-ddc4417fd243		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{164E0A2F-80E2-43B2-AB3A-DDC4417FD243}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	18	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	164e0a2f-80e2-43b2-ab3a-ddc4417fd243		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{C2F5568D-4510-4159-84FD-DC1548A7133D}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	17	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	c2f5568d-4510-4159-84fd-dc1548a7133d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{C2F5568D-4510-4159-84FD-DC1548A7133D}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	16	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2832	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:19 AM	c2f5568d-4510-4159-84fd-dc1548a7133d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{043EE715-21ED-422B-BC21-0A421167B7FB}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{4A2D383E-01B1-420A-A4EF-4F71391CDE3B}" completes.	324	0		3	324	0	-9223372036854775808	15	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:14 AM	043ee715-21ed-422b-bc21-0a421167b7fb		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{462668AB-57BD-44E0-B913-E8C7768B6179}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" and will launch it as soon as instance "{164E0A2F-80E2-43B2-AB3A-DDC4417FD243}" completes.	324	0		3	324	0	-9223372036854775808	14	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2816	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:14 AM	462668ab-57bd-44e0-b913-e8c7768b6179		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{2E77656F-AFCD-4642-A8EE-5EEA14F1D8AA}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{4A2D383E-01B1-420A-A4EF-4F71391CDE3B}" completes.	324	0		3	324	0	-9223372036854775808	13	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:14 AM	2e77656f-afcd-4642-a8ee-5eea14f1d8aa		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{C2F5568D-4510-4159-84FD-DC1548A7133D}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	12	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2924	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:14 AM	c2f5568d-4510-4159-84fd-dc1548a7133d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{C2F5568D-4510-4159-84FD-DC1548A7133D}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	11	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2924	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:14 AM	c2f5568d-4510-4159-84fd-dc1548a7133d		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{164E0A2F-80E2-43B2-AB3A-DDC4417FD243}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	10	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1512	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:14 AM	164e0a2f-80e2-43b2-ab3a-ddc4417fd243		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{164E0A2F-80E2-43B2-AB3A-DDC4417FD243}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	9	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1512	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:14 AM	164e0a2f-80e2-43b2-ab3a-ddc4417fd243		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{7CBEB82A-0DAD-48E5-AEA9-55E85C82BEDF}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	8	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:14 AM	7cbeb82a-0dad-48e5-aea9-55e85c82bedf		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{7CBEB82A-0DAD-48E5-AEA9-55E85C82BEDF}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	7	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2836	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:14 AM	7cbeb82a-0dad-48e5-aea9-55e85c82bedf		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\compattelrunner.exe" in instance "{6426B075-EB52-4282-A7EC-869A637F944F}" of task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser".	200	1		4	200	1	-9223372036854775808	6	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:11 AM	6426b075-eb52-4282-a7ec-869a637f944f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{6426B075-EB52-4282-A7EC-869A637F944F}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	5	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:11 AM	6426b075-eb52-4282-a7ec-869a637f944f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "%windir%\system32\compattelrunner.exe" with process ID 3128.	129	0		4	129	0	-9223372036854775808	4	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	2568	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:11 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{4A2D383E-01B1-420A-A4EF-4F71391CDE3B}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	3	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1904	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:11 AM	4a2d383e-01b1-420a-a4ef-4f71391cde3b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{4A2D383E-01B1-420A-A4EF-4F71391CDE3B}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	2	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1904	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:11 AM	4a2d383e-01b1-420a-a4ef-4f71391cde3b		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 3108.	129	0		4	129	0	-9223372036854775808	1	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1472	1904	n-h1-829049-1.cbci-829049-1.local	S-1-5-18	6/2/2022 3:01:11 AM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]