Message	Id	Version	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
Task Scheduler successfully finished "{EDEC0D7E-E04C-4879-88CD-FE04F0D1CDA2}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	145	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 1:10:02 PM	edec0d7e-e04c-4879-88cd-fe04f0d1cda2	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{EDEC0D7E-E04C-4879-88CD-FE04F0D1CDA2}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	144	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 1:10:02 PM	edec0d7e-e04c-4879-88cd-fe04f0d1cda2	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{EDEC0D7E-E04C-4879-88CD-FE04F0D1CDA2}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1	4	200	1	-9223372036854775808	143	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 1:10:02 PM	edec0d7e-e04c-4879-88cd-fe04f0d1cda2	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{EDEC0D7E-E04C-4879-88CD-FE04F0D1CDA2}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	142	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 1:10:02 PM	edec0d7e-e04c-4879-88cd-fe04f0d1cda2	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 2444.	129	0	4	129	0	-9223372036854775808	141	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 1:10:02 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{EDEC0D7E-E04C-4879-88CD-FE04F0D1CDA2}" instance of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" due to a time trigger condition.	107	0	4	107	0	-9223372036854775808	140	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 1:10:02 PM	edec0d7e-e04c-4879-88cd-fe04f0d1cda2	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered on scheduler	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-832156-2\N-H2-832156-2$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	139	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 1:04:01 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-832156-2\N-H2-832156-2$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	138	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:34:01 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "NT AUTHORITY\SYSTEM" updated Task Scheduler task "\Microsoft\Windows\WindowsUpdate\Scheduled Start"	140	0	4	140	0	-9223372036854775808	137	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:10:13 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-832156-2\N-H2-832156-2$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	136	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:04:00 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{66C571E4-F7FB-4B07-8234-2E092A53914C}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	135	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	5528	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM	66c571e4-f7fb-4b07-8234-2e092a53914c	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{66C571E4-F7FB-4B07-8234-2E092A53914C}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	134	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	5528	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM	66c571e4-f7fb-4b07-8234-2e092a53914c	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{66C571E4-F7FB-4B07-8234-2E092A53914C}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	133	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	5528	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM	66c571e4-f7fb-4b07-8234-2e092a53914c	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{66C571E4-F7FB-4B07-8234-2E092A53914C}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	132	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	5528	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM	66c571e4-f7fb-4b07-8234-2e092a53914c	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 6136.	129	0	4	129	0	-9223372036854775808	131	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	5528	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{747DD892-FBBC-4288-B216-264C60A65E9E}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	130	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM	747dd892-fbbc-4288-b216-264c60a65e9e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{747DD892-FBBC-4288-B216-264C60A65E9E}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	129	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM	747dd892-fbbc-4288-b216-264c60a65e9e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{80002F28-9D08-4000-85A4-0BCD081BEF22}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	128	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM	80002f28-9d08-4000-85a4-0bcd081bef22	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{80002F28-9D08-4000-85A4-0BCD081BEF22}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	127	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM	80002f28-9d08-4000-85a4-0bcd081bef22	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{80002F28-9D08-4000-85A4-0BCD081BEF22}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1	4	200	1	-9223372036854775808	126	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM	80002f28-9d08-4000-85a4-0bcd081bef22	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{80002F28-9D08-4000-85A4-0BCD081BEF22}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	125	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM	80002f28-9d08-4000-85a4-0bcd081bef22	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{747DD892-FBBC-4288-B216-264C60A65E9E}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	124	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM	747dd892-fbbc-4288-b216-264c60a65e9e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{747DD892-FBBC-4288-B216-264C60A65E9E}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	123	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM	747dd892-fbbc-4288-b216-264c60a65e9e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 3972.	129	0	4	129	0	-9223372036854775808	122	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:12 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{2040907E-F71B-4DCA-B714-E33C89D1954D}" instance of the "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	121	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:01 PM	2040907e-f71b-4dca-b714-e33c89d1954d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" , instance "{2040907E-F71B-4DCA-B714-E33C89D1954D}" , action "%SystemRoot%\System32\wsqmcons.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	120	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:01 PM	2040907e-f71b-4dca-b714-e33c89d1954d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%SystemRoot%\System32\wsqmcons.exe" in instance "{2040907E-F71B-4DCA-B714-E33C89D1954D}" of task "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator".	200	1	4	200	1	-9223372036854775808	119	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:01 PM	2040907e-f71b-4dca-b714-e33c89d1954d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{2040907E-F71B-4DCA-B714-E33C89D1954D}" instance of the "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	118	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:01 PM	2040907e-f71b-4dca-b714-e33c89d1954d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" , instance "%SystemRoot%\System32\wsqmcons.exe" with process ID 5012.	129	0	4	129	0	-9223372036854775808	117	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:01 PM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{2040907E-F71B-4DCA-B714-E33C89D1954D}" instance of task "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" due to a time trigger condition.	107	0	4	107	0	-9223372036854775808	116	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 12:00:01 PM	2040907e-f71b-4dca-b714-e33c89d1954d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered on scheduler	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{41921EE2-ACDB-4705-B1EC-92C1EAF58D77}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	115	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2864	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:58:13 AM	41921ee2-acdb-4705-b1ec-92c1eaf58d77	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{41921EE2-ACDB-4705-B1EC-92C1EAF58D77}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	114	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2864	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:58:13 AM	41921ee2-acdb-4705-b1ec-92c1eaf58d77	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{41921EE2-ACDB-4705-B1EC-92C1EAF58D77}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1	4	200	1	-9223372036854775808	113	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:58:11 AM	41921ee2-acdb-4705-b1ec-92c1eaf58d77	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{41921EE2-ACDB-4705-B1EC-92C1EAF58D77}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	112	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:58:11 AM	41921ee2-acdb-4705-b1ec-92c1eaf58d77	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 4212.	129	0	4	129	0	-9223372036854775808	111	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:58:11 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{00000000-0000-0000-0000-000000000000}" instance of task "\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents" according to an event trigger.	108	0	4	108	0	-9223372036854775808	110	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1532	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:58:11 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered on event	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{73E744F8-35A1-48ED-A321-485CB9D36528}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	109	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1532	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:43:29 AM	73e744f8-35a1-48ed-a321-485cb9d36528	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Autochk\Proxy" , instance "{73E744F8-35A1-48ED-A321-485CB9D36528}" , action "%windir%\system32\rundll32.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	108	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1532	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:43:29 AM	73e744f8-35a1-48ed-a321-485cb9d36528	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\rundll32.exe" in instance "{73E744F8-35A1-48ED-A321-485CB9D36528}" of task "\Microsoft\Windows\Autochk\Proxy".	200	1	4	200	1	-9223372036854775808	107	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1532	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:43:29 AM	73e744f8-35a1-48ed-a321-485cb9d36528	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{73E744F8-35A1-48ED-A321-485CB9D36528}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	106	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1532	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:43:29 AM	73e744f8-35a1-48ed-a321-485cb9d36528	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Autochk\Proxy" , instance "%windir%\system32\rundll32.exe" with process ID 3108.	129	0	4	129	0	-9223372036854775808	105	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1532	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:43:29 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{73E744F8-35A1-48ED-A321-485CB9D36528}" instance of task "\Microsoft\Windows\Autochk\Proxy" due to system startup.	118	0	4	118	0	-9223372036854775808	104	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1532	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:43:29 AM	73e744f8-35a1-48ed-a321-485cb9d36528	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "NT AUTHORITY\SYSTEM" updated Task Scheduler task "\Microsoft\Windows\WindowsUpdate\Scheduled Start"	140	0	4	140	0	-9223372036854775808	103	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:37:01 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-832156-2\N-H2-832156-2$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	102	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2936	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:34:00 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "NT AUTHORITY\SYSTEM" updated Task Scheduler task "\Microsoft\Windows\WindowsUpdate\Scheduled Start"	140	0	4	140	0	-9223372036854775808	101	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:21:36 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{17E14C57-A347-4A76-92F1-8C0C1A0280F9}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	100	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2936	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:13:29 AM	17e14c57-a347-4a76-92f1-8c0c1a0280f9	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "{17E14C57-A347-4A76-92F1-8C0C1A0280F9}" , action "%windir%\System32\XblGameSaveTask.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	99	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2936	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:13:29 AM	17e14c57-a347-4a76-92f1-8c0c1a0280f9	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\System32\XblGameSaveTask.exe" in instance "{17E14C57-A347-4A76-92F1-8C0C1A0280F9}" of task "\Microsoft\XblGameSave\XblGameSaveTask".	200	1	4	200	1	-9223372036854775808	98	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2936	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:13:29 AM	17e14c57-a347-4a76-92f1-8c0c1a0280f9	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{17E14C57-A347-4A76-92F1-8C0C1A0280F9}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	97	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2936	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:13:29 AM	17e14c57-a347-4a76-92f1-8c0c1a0280f9	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "%windir%\System32\XblGameSaveTask.exe" with process ID 3436.	129	0	4	129	0	-9223372036854775808	96	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2936	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:13:29 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" disabled Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	142	0	4	142	0	-9223372036854775808	95	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:30 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task disabled	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{89666DF2-94AA-4B8E-A320-C77F3F62FA3E}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	94	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:30 AM	89666df2-94aa-4b8e-a320-c77f3f62fa3e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{89666DF2-94AA-4B8E-A320-C77F3F62FA3E}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	93	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:30 AM	89666df2-94aa-4b8e-a320-c77f3f62fa3e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-832156-2\N-H2-832156-2$" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan"	140	0	4	140	0	-9223372036854775808	92	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:30 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{59C7E192-6188-4F68-83EB-5B3B42D45142}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	91	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:29 AM	59c7e192-6188-4f68-83eb-5b3b42d45142	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "{59C7E192-6188-4F68-83EB-5B3B42D45142}" , action "%systemroot%\system32\usoclient.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	90	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:29 AM	59c7e192-6188-4f68-83eb-5b3b42d45142	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	140	0	4	140	0	-9223372036854775808	89	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2340	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:29 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{89666DF2-94AA-4B8E-A320-C77F3F62FA3E}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1	4	200	1	-9223372036854775808	88	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:29 AM	89666df2-94aa-4b8e-a320-c77f3f62fa3e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{89666DF2-94AA-4B8E-A320-C77F3F62FA3E}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	87	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:29 AM	89666df2-94aa-4b8e-a320-c77f3f62fa3e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 4768.	129	0	4	129	0	-9223372036854775808	86	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:29 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{89666DF2-94AA-4B8E-A320-C77F3F62FA3E}" instance of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" due to system startup.	118	0	4	118	0	-9223372036854775808	85	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:29 AM	89666df2-94aa-4b8e-a320-c77f3f62fa3e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\usoclient.exe" in instance "{59C7E192-6188-4F68-83EB-5B3B42D45142}" of task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan".	200	1	4	200	1	-9223372036854775808	84	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:29 AM	59c7e192-6188-4f68-83eb-5b3b42d45142	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{59C7E192-6188-4F68-83EB-5B3B42D45142}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	83	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:29 AM	59c7e192-6188-4f68-83eb-5b3b42d45142	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "%systemroot%\system32\usoclient.exe" with process ID 836.	129	0	4	129	0	-9223372036854775808	82	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:29 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler could not launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" as scheduled. Instance "{59C7E192-6188-4F68-83EB-5B3B42D45142}" is started now as required by the configuration option to start the task when available, if schedule is missed.	114	0	3	114	0	-9223372036854775808	81	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:29 AM	59c7e192-6188-4f68-83eb-5b3b42d45142	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Missed task started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-832156-2\N-H2-832156-2$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	80	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2760	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:06:01 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{EED0C09B-92D3-4428-8B96-C213496CDC83}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	79	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2760	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:05:18 AM	eed0c09b-92d3-4428-8b96-c213496cdc83	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "{EED0C09B-92D3-4428-8B96-C213496CDC83}" , action "%windir%\system32\compattelrunner.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	78	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2760	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:05:18 AM	eed0c09b-92d3-4428-8b96-c213496cdc83	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{C99EE357-9660-41BD-B6DF-942CD545F757}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	77	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2308	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:31 AM	c99ee357-9660-41bd-b6df-942cd545f757	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "{C99EE357-9660-41BD-B6DF-942CD545F757}" , action "%systemroot%\system32\cmd.exe" with return code 0.	201	2	4	201	2	-9223372036854775808	76	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2308	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:31 AM	c99ee357-9660-41bd-b6df-942cd545f757	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\cmd.exe" in instance "{C99EE357-9660-41BD-B6DF-942CD545F757}" of task "\Microsoft\Windows\Software Inventory Logging\Configuration".	200	1	4	200	1	-9223372036854775808	75	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2760	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:29 AM	c99ee357-9660-41bd-b6df-942cd545f757	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{C99EE357-9660-41BD-B6DF-942CD545F757}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	74	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2760	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:29 AM	c99ee357-9660-41bd-b6df-942cd545f757	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "%systemroot%\system32\cmd.exe" with process ID 3712.	129	0	4	129	0	-9223372036854775808	73	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2760	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:29 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{C99EE357-9660-41BD-B6DF-942CD545F757}" instance of task "\Microsoft\Windows\Software Inventory Logging\Configuration" due to system startup.	118	0	4	118	0	-9223372036854775808	72	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2760	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:29 AM	c99ee357-9660-41bd-b6df-942cd545f757	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-832156-2\N-H2-832156-2$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0	4	140	0	-9223372036854775808	71	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:10 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{46986E07-8817-4AB3-AB4D-B633813E0E1B}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	70	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:07 AM	46986e07-8817-4ab3-ab4d-b633813e0e1b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{46986E07-8817-4AB3-AB4D-B633813E0E1B}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	69	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:07 AM	46986e07-8817-4ab3-ab4d-b633813e0e1b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{46986E07-8817-4AB3-AB4D-B633813E0E1B}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1	4	200	1	-9223372036854775808	68	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:07 AM	46986e07-8817-4ab3-ab4d-b633813e0e1b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{46986E07-8817-4AB3-AB4D-B633813E0E1B}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	67	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:07 AM	46986e07-8817-4ab3-ab4d-b633813e0e1b	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "taskhostw.exe" with process ID 4812.	129	0	4	129	0	-9223372036854775808	66	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:07 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{398BD435-7F31-4377-B6CC-73D766E0ED66}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	65	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2760	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:07 AM	398bd435-7f31-4377-b6cc-73d766e0ed66	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{398BD435-7F31-4377-B6CC-73D766E0ED66}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	64	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2760	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:07 AM	398bd435-7f31-4377-b6cc-73d766e0ed66	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{398BD435-7F31-4377-B6CC-73D766E0ED66}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	63	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2760	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:07 AM	398bd435-7f31-4377-b6cc-73d766e0ed66	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{398BD435-7F31-4377-B6CC-73D766E0ED66}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	62	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2760	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:07 AM	398bd435-7f31-4377-b6cc-73d766e0ed66	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 3956.	129	0	4	129	0	-9223372036854775808	61	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2760	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:07 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{A68D7957-BC29-45CC-AD45-B60D412021B0}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	60	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2928	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:07 AM	a68d7957-bc29-45cc-ad45-b60d412021b0	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{A68D7957-BC29-45CC-AD45-B60D412021B0}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	59	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2928	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:07 AM	a68d7957-bc29-45cc-ad45-b60d412021b0	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{A68D7957-BC29-45CC-AD45-B60D412021B0}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	58	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2928	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:06 AM	a68d7957-bc29-45cc-ad45-b60d412021b0	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{A68D7957-BC29-45CC-AD45-B60D412021B0}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	57	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2928	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:06 AM	a68d7957-bc29-45cc-ad45-b60d412021b0	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 4216.	129	0	4	129	0	-9223372036854775808	56	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2928	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:04:06 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{689531DB-3F0A-40B9-834B-399D215B2A0D}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	55	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:58 AM	689531db-3f0a-40b9-834b-399d215b2a0d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{689531DB-3F0A-40B9-834B-399D215B2A0D}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	54	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:58 AM	689531db-3f0a-40b9-834b-399d215b2a0d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{689531DB-3F0A-40B9-834B-399D215B2A0D}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	53	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:58 AM	689531db-3f0a-40b9-834b-399d215b2a0d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{689531DB-3F0A-40B9-834B-399D215B2A0D}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	52	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:58 AM	689531db-3f0a-40b9-834b-399d215b2a0d	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 5104.	129	0	4	129	0	-9223372036854775808	51	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:58 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{0092252B-613B-48B0-AD97-ECC667B72D55}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	50	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:58 AM	0092252b-613b-48b0-ad97-ecc667b72d55	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{0092252B-613B-48B0-AD97-ECC667B72D55}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	49	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:58 AM	0092252b-613b-48b0-ad97-ecc667b72d55	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{0B815093-BF19-4C4D-B64B-BB4475C63B64}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	48	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:58 AM	0b815093-bf19-4c4d-b64b-bb4475c63b64	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{0B815093-BF19-4C4D-B64B-BB4475C63B64}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	47	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:58 AM	0b815093-bf19-4c4d-b64b-bb4475c63b64	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{0B815093-BF19-4C4D-B64B-BB4475C63B64}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1	4	200	1	-9223372036854775808	46	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:57 AM	0b815093-bf19-4c4d-b64b-bb4475c63b64	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{0B815093-BF19-4C4D-B64B-BB4475C63B64}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	45	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:57 AM	0b815093-bf19-4c4d-b64b-bb4475c63b64	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{0092252B-613B-48B0-AD97-ECC667B72D55}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	44	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:57 AM	0092252b-613b-48b0-ad97-ecc667b72d55	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{0092252B-613B-48B0-AD97-ECC667B72D55}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	43	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:57 AM	0092252b-613b-48b0-ad97-ecc667b72d55	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 5036.	129	0	4	129	0	-9223372036854775808	42	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:57 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{6C354764-B7E7-48EA-9A3E-78DEBEE961BD}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	41	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:39 AM	6c354764-b7e7-48ea-9a3e-78debee961bd	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{6C354764-B7E7-48EA-9A3E-78DEBEE961BD}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	40	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:39 AM	6c354764-b7e7-48ea-9a3e-78debee961bd	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{6C354764-B7E7-48EA-9A3E-78DEBEE961BD}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	39	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:39 AM	6c354764-b7e7-48ea-9a3e-78debee961bd	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{6C354764-B7E7-48EA-9A3E-78DEBEE961BD}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	38	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:39 AM	6c354764-b7e7-48ea-9a3e-78debee961bd	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 3980.	129	0	4	129	0	-9223372036854775808	37	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:39 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{6C354764-B7E7-48EA-9A3E-78DEBEE961BD}" instance of task "\Microsoft\Windows\CertificateServicesClient\SystemTask" due to system startup.	118	0	4	118	0	-9223372036854775808	36	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:39 AM	6c354764-b7e7-48ea-9a3e-78debee961bd	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{E9FD03A7-F6AC-4A3F-99B8-9B8E3DB342D5}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	35	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	e9fd03a7-f6ac-4a3f-99b8-9b8e3db342d5	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{E9FD03A7-F6AC-4A3F-99B8-9B8E3DB342D5}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	34	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	e9fd03a7-f6ac-4a3f-99b8-9b8e3db342d5	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{182F8A0A-BC17-4117-A05D-627280C8C037}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	33	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	182f8a0a-bc17-4117-a05d-627280c8c037	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{182F8A0A-BC17-4117-A05D-627280C8C037}" , action "Certificate Services Client Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	32	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	182f8a0a-bc17-4117-a05d-627280c8c037	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{7FDE1D97-10DE-465C-9ED5-967CDCCDDE20}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	31	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	7fde1d97-10de-465c-9ed5-967cdccdde20	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{7FDE1D97-10DE-465C-9ED5-967CDCCDDE20}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	30	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	7fde1d97-10de-465c-9ed5-967cdccdde20	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{79F129DE-60BA-418F-8191-C4D904A288AD}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	29	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	79f129de-60ba-418f-8191-c4d904a288ad	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{79F129DE-60BA-418F-8191-C4D904A288AD}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	28	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	79f129de-60ba-418f-8191-c4d904a288ad	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{79F129DE-60BA-418F-8191-C4D904A288AD}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	27	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	3640	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	79f129de-60ba-418f-8191-c4d904a288ad	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{79F129DE-60BA-418F-8191-C4D904A288AD}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	26	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	3640	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	79f129de-60ba-418f-8191-c4d904a288ad	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{37E16AC0-786C-4E5F-8B36-419013F0D685}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	25	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	37e16ac0-786c-4e5f-8b36-419013f0d685	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{37E16AC0-786C-4E5F-8B36-419013F0D685}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	24	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	37e16ac0-786c-4e5f-8b36-419013f0d685	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{7FDE1D97-10DE-465C-9ED5-967CDCCDDE20}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1	4	200	1	-9223372036854775808	23	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2108	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	7fde1d97-10de-465c-9ed5-967cdccdde20	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{7FDE1D97-10DE-465C-9ED5-967CDCCDDE20}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	22	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2108	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	7fde1d97-10de-465c-9ed5-967cdccdde20	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{6AB93839-9FD5-4BEE-9835-F91154A0D612}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	21	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	6ab93839-9fd5-4bee-9835-f91154a0d612	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{6AB93839-9FD5-4BEE-9835-F91154A0D612}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	20	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	6ab93839-9fd5-4bee-9835-f91154a0d612	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{37E16AC0-786C-4E5F-8B36-419013F0D685}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	19	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	3640	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	37e16ac0-786c-4e5f-8b36-419013f0d685	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{37E16AC0-786C-4E5F-8B36-419013F0D685}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	18	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	3640	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	37e16ac0-786c-4e5f-8b36-419013f0d685	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{D486518B-7C0C-499B-9EA1-42B46CBD649E}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0	4	102	2	-9223372036854775807	17	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	d486518b-7c0c-499b-9ea1-42b46cbd649e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{D486518B-7C0C-499B-9EA1-42B46CBD649E}" , action "TPM Maintenance Task Handler" with return code 0.	201	2	4	201	2	-9223372036854775808	16	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1780	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:38 AM	d486518b-7c0c-499b-9ea1-42b46cbd649e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{79F129DE-60BA-418F-8191-C4D904A288AD}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{D486518B-7C0C-499B-9EA1-42B46CBD649E}" completes.	324	0	3	324	0	-9223372036854775808	15	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:34 AM	79f129de-60ba-418f-8191-c4d904a288ad	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{7FDE1D97-10DE-465C-9ED5-967CDCCDDE20}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" and will launch it as soon as instance "{6AB93839-9FD5-4BEE-9835-F91154A0D612}" completes.	324	0	3	324	0	-9223372036854775808	14	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1800	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:34 AM	7fde1d97-10de-465c-9ed5-967cdccdde20	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{37E16AC0-786C-4E5F-8B36-419013F0D685}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{D486518B-7C0C-499B-9EA1-42B46CBD649E}" completes.	324	0	3	324	0	-9223372036854775808	13	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	1744	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:34 AM	37e16ac0-786c-4e5f-8b36-419013f0d685	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{E9FD03A7-F6AC-4A3F-99B8-9B8E3DB342D5}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	12	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2340	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:34 AM	e9fd03a7-f6ac-4a3f-99b8-9b8e3db342d5	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{E9FD03A7-F6AC-4A3F-99B8-9B8E3DB342D5}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	11	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2340	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:34 AM	e9fd03a7-f6ac-4a3f-99b8-9b8e3db342d5	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{6AB93839-9FD5-4BEE-9835-F91154A0D612}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1	4	200	1	-9223372036854775808	10	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2268	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:34 AM	6ab93839-9fd5-4bee-9835-f91154a0d612	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{6AB93839-9FD5-4BEE-9835-F91154A0D612}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	9	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2268	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:34 AM	6ab93839-9fd5-4bee-9835-f91154a0d612	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{182F8A0A-BC17-4117-A05D-627280C8C037}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1	4	200	1	-9223372036854775808	8	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2268	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:34 AM	182f8a0a-bc17-4117-a05d-627280c8c037	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{182F8A0A-BC17-4117-A05D-627280C8C037}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	7	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2268	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:34 AM	182f8a0a-bc17-4117-a05d-627280c8c037	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\compattelrunner.exe" in instance "{EED0C09B-92D3-4428-8B96-C213496CDC83}" of task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser".	200	1	4	200	1	-9223372036854775808	6	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:31 AM	eed0c09b-92d3-4428-8b96-c213496cdc83	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{EED0C09B-92D3-4428-8B96-C213496CDC83}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	5	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:31 AM	eed0c09b-92d3-4428-8b96-c213496cdc83	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "%windir%\system32\compattelrunner.exe" with process ID 2348.	129	0	4	129	0	-9223372036854775808	4	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:31 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{D486518B-7C0C-499B-9EA1-42B46CBD649E}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1	4	200	1	-9223372036854775808	3	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:30 AM	d486518b-7c0c-499b-9ea1-42b46cbd649e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{D486518B-7C0C-499B-9EA1-42B46CBD649E}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0	4	100	1	-9223372036854775807	2	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:30 AM	d486518b-7c0c-499b-9ea1-42b46cbd649e	microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 2788.	129	0	4	129	0	-9223372036854775808	1	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1468	2964	n-h2-832156-2.cbci-832156-2.local	S-1-5-18	3/5/2022 11:03:30 AM		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]