Message | Id | Version | Qualifiers | Level | Task | Opcode | Keywords | RecordId | ProviderName | ProviderId | LogName | ProcessId | ThreadId | MachineName | UserId | TimeCreated | ActivityId | RelatedActivityId | ContainerLog | MatchedQueryIds | Bookmark | LevelDisplayName | OpcodeDisplayName | TaskDisplayName | KeywordsDisplayNames | Properties |
Next policy processing for CBCI-845747-2\N-H2-845747-2$ will be attempted in 106 minutes. | 5315 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 761 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed periodic policy processing for computer CBCI-845747-2\N-H2-845747-2$ in 0 seconds. | 8006 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 760 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 759 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 758 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 757 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 756 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
Default Domain Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 755 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 754 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 753 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The system calls to access specified file completed.
\\cbci-845747-2.local\sysvol\cbci-845747-2.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini
The call completed in 15 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 752 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making system calls to access specified file.
\\cbci-845747-2.local\sysvol\cbci-845747-2.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini | 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 751 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A fast link was detected. The Estimated bandwidth is 27167 kbps. The slow link threshold is 500 kbps. | 5314 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 750 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Estimated network bandwidth on one of the connections: 3395956 kbps. | 5327 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 749 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting to download policies. | 4257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 748 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 747 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 746 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Account details:
Account Name : CN=N-H2-845747-2,CN=Computers,DC=cbci-845747-2,DC=local
Account Domain Name : cbci-845747-2.local
DC Name : \\n-ad-845747-2.cbci-845747-2.local
DC Domain Name : cbci-845747-2.local | 5310 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 745 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Computer details:
Computer role : 2
Network name : openstacklocal | 5309 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 744 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully discovered the Domain Controller in 15 milliseconds. | 5326 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 743 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Domain Controller details:
Domain Controller Name : n-ad-845747-2.cbci-845747-2.local
Domain Controller IP Address : 10.222.0.33 | 5308 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 742 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The LDAP call to connect and bind to Active Directory completed.
n-ad-845747-2.cbci-845747-2.local
The call completed in 15 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 741 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making LDAP calls to connect and bind to Active Directory.
n-ad-845747-2.cbci-845747-2.local | 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 740 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Retrieving Domain Controller details. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 739 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy is trying to discover the Domain Controller information. | 4326 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 738 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Retrieved account information. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 737 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The system call to get account information completed.
CN=N-H2-845747-2,CN=Computers,DC=cbci-845747-2,DC=local
The call completed in 0 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 736 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making system call to get account information.
| 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 735 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Attempting to retrieve the account information. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 734 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Background. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 733 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting periodic policy processing for computer CBCI-845747-2\N-H2-845747-2$.
Activity id: {D4D43E43-A52F-44AA-9C8C-646F69148193} | 4006 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 732 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 3:52:13 PM | d4d43e43-a52f-44aa-9c8c-646f69148193 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Next policy processing for CBCI-845747-2\N-H2-845747-2$ will be attempted in 95 minutes. | 5315 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 731 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed manual processing of policy for computer CBCI-845747-2\N-H2-845747-2$ in 0 seconds. | 8004 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 730 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed Registry Extension Processing in 32 milliseconds. | 5016 | 0 | | 4 | 0 | 2 | 4611686018427387904 | 729 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting Registry Extension Processing.
List of applicable Group Policy objects: (Changes were detected.)
Local Group Policy
| 4016 | 0 | | 4 | 0 | 1 | 4611686018427387904 | 728 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 727 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 726 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 725 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 724 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
Default Domain Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 723 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 722 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 721 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The system calls to access specified file completed.
\\cbci-845747-2.local\sysvol\cbci-845747-2.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini
The call completed in 0 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 720 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making system calls to access specified file.
\\cbci-845747-2.local\sysvol\cbci-845747-2.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini | 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 719 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A fast link was detected. The Estimated bandwidth is 5775 kbps. The slow link threshold is 500 kbps. | 5314 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 718 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Estimated network bandwidth on one of the connections: 721970 kbps. | 5327 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 717 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting to download policies. | 4257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 716 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 715 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 714 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Account details:
Account Name : CN=N-H2-845747-2,CN=Computers,DC=cbci-845747-2,DC=local
Account Domain Name : cbci-845747-2.local
DC Name : \\n-ad-845747-2.cbci-845747-2.local
DC Domain Name : cbci-845747-2.local | 5310 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 713 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Computer details:
Computer role : 2
Network name : openstacklocal | 5309 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 712 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully discovered the Domain Controller in 31 milliseconds. | 5326 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 711 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Domain Controller details:
Domain Controller Name : n-ad-845747-2.cbci-845747-2.local
Domain Controller IP Address : 10.222.0.33 | 5308 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 710 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The LDAP call to connect and bind to Active Directory completed.
n-ad-845747-2.cbci-845747-2.local
The call completed in 0 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 709 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making LDAP calls to connect and bind to Active Directory.
n-ad-845747-2.cbci-845747-2.local | 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 708 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Retrieving Domain Controller details. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 707 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy is trying to discover the Domain Controller information. | 4326 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 706 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Retrieved account information. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 705 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The system call to get account information completed.
CN=N-H2-845747-2,CN=Computers,DC=cbci-845747-2,DC=local
The call completed in 0 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 704 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making system call to get account information.
| 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 703 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Attempting to retrieve the account information. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 702 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Background. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 701 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting manual processing of policy for computer CBCI-845747-2\N-H2-845747-2$.
Activity id: {511AF1BF-6CD6-4ADF-8796-B6C4C5048A06} | 4004 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 700 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:13 PM | 511af1bf-6cd6-4adf-8796-b6c4c5048a06 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Next policy processing for CBCI-845747-2\N-H2-845747-2$ will be attempted in 115 minutes. | 5315 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 699 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed manual processing of policy for computer CBCI-845747-2\N-H2-845747-2$ in 0 seconds. | 8004 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 698 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed Registry Extension Processing in 31 milliseconds. | 5016 | 0 | | 4 | 0 | 2 | 4611686018427387904 | 697 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting Registry Extension Processing.
List of applicable Group Policy objects: (Changes were detected.)
Local Group Policy
| 4016 | 0 | | 4 | 0 | 1 | 4611686018427387904 | 696 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 695 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 694 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 693 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 692 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
Default Domain Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 691 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 690 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 689 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The system calls to access specified file completed.
\\cbci-845747-2.local\sysvol\cbci-845747-2.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini
The call completed in 16 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 688 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making system calls to access specified file.
\\cbci-845747-2.local\sysvol\cbci-845747-2.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini | 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 687 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A fast link was detected. The Estimated bandwidth is 11822 kbps. The slow link threshold is 500 kbps. | 5314 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 686 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Estimated network bandwidth on one of the connections: 1477858 kbps. | 5327 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 685 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:04 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting to download policies. | 4257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 684 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 683 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 682 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Account details:
Account Name : CN=N-H2-845747-2,CN=Computers,DC=cbci-845747-2,DC=local
Account Domain Name : cbci-845747-2.local
DC Name : \\n-ad-845747-2.cbci-845747-2.local
DC Domain Name : cbci-845747-2.local | 5310 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 681 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Computer details:
Computer role : 2
Network name : openstacklocal | 5309 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 680 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully discovered the Domain Controller in 15 milliseconds. | 5326 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 679 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Domain Controller details:
Domain Controller Name : n-ad-845747-2.cbci-845747-2.local
Domain Controller IP Address : 10.222.0.33 | 5308 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 678 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The LDAP call to connect and bind to Active Directory completed.
n-ad-845747-2.cbci-845747-2.local
The call completed in 15 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 677 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making LDAP calls to connect and bind to Active Directory.
n-ad-845747-2.cbci-845747-2.local | 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 676 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Retrieving Domain Controller details. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 675 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy is trying to discover the Domain Controller information. | 4326 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 674 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Retrieved account information. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 673 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The system call to get account information completed.
CN=N-H2-845747-2,CN=Computers,DC=cbci-845747-2,DC=local
The call completed in 0 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 672 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making system call to get account information.
| 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 671 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Attempting to retrieve the account information. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 670 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Background. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 669 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting manual processing of policy for computer CBCI-845747-2\N-H2-845747-2$.
Activity id: {A0344295-9CE8-4B05-B1DB-4F7945BD37CE} | 4004 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 668 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:17:03 PM | a0344295-9ce8-4b05-b1db-4f7945bd37ce | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Next policy processing for CBCI-845747-2\N-H2-845747-2$ will be attempted in 110 minutes. | 5315 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 667 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:35 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed manual processing of policy for computer CBCI-845747-2\N-H2-845747-2$ in 0 seconds. | 8004 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 666 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:35 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed Registry Extension Processing in 31 milliseconds. | 5016 | 0 | | 4 | 0 | 2 | 4611686018427387904 | 665 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting Registry Extension Processing.
List of applicable Group Policy objects: (Changes were detected.)
Local Group Policy
| 4016 | 0 | | 4 | 0 | 1 | 4611686018427387904 | 664 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 663 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 662 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 661 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 660 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
Default Domain Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 659 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 658 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 657 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The system calls to access specified file completed.
\\cbci-845747-2.local\sysvol\cbci-845747-2.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini
The call completed in 0 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 656 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making system calls to access specified file.
\\cbci-845747-2.local\sysvol\cbci-845747-2.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini | 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 655 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A fast link was detected. The Estimated bandwidth is 48695 kbps. The slow link threshold is 500 kbps. | 5314 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 654 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Estimated network bandwidth on one of the connections: 6086961 kbps. | 5327 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 653 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting to download policies. | 4257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 652 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 651 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 650 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Account details:
Account Name : CN=N-H2-845747-2,CN=Computers,DC=cbci-845747-2,DC=local
Account Domain Name : cbci-845747-2.local
DC Name : \\n-ad-845747-2.cbci-845747-2.local
DC Domain Name : cbci-845747-2.local | 5310 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 649 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Computer details:
Computer role : 2
Network name : openstacklocal | 5309 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 648 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully discovered the Domain Controller in 125 milliseconds. | 5326 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 647 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Domain Controller details:
Domain Controller Name : n-ad-845747-2.cbci-845747-2.local
Domain Controller IP Address : 10.222.0.33 | 5308 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 646 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The LDAP call to connect and bind to Active Directory completed.
n-ad-845747-2.cbci-845747-2.local
The call completed in 0 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 645 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making LDAP calls to connect and bind to Active Directory.
n-ad-845747-2.cbci-845747-2.local | 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 644 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Retrieving Domain Controller details. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 643 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy is trying to discover the Domain Controller information. | 4326 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 642 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Retrieved account information. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 641 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The system call to get account information completed.
CN=N-H2-845747-2,CN=Computers,DC=cbci-845747-2,DC=local
The call completed in 0 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 640 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making system call to get account information.
| 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 639 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Attempting to retrieve the account information. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 638 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Background. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 637 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting manual processing of policy for computer CBCI-845747-2\N-H2-845747-2$.
Activity id: {BF5D5C39-FD50-4909-A4FC-F8F667B47D5F} | 4004 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 636 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:34 PM | bf5d5c39-fd50-4909-a4fc-f8f667b47d5f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Next policy processing for CBCI-845747-2\N-H2-845747-2$ will be attempted in 100 minutes. | 5315 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 635 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 3220 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:33 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 634 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2776 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:33 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 633 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2776 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:33 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 632 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:33 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed computer boot policy processing for CBCI-845747-2\N-H2-845747-2$ in 2 seconds. | 8000 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 631 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:33 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed Security Extension Processing in 532 milliseconds. | 5016 | 0 | | 4 | 0 | 2 | 4611686018427387904 | 630 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:33 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 629 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2776 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:33 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 628 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2776 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:33 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 627 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2776 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:33 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 626 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2776 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 625 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 624 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 623 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 622 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 621 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 620 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 619 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 618 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 617 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 616 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 615 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting Security Extension Processing.
List of applicable Group Policy objects: (Changes were detected.)
Default Domain Policy
| 4016 | 0 | | 4 | 0 | 1 | 4611686018427387904 | 614 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed Registry Extension Processing in 16 milliseconds. | 5016 | 0 | | 4 | 0 | 2 | 4611686018427387904 | 613 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 612 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 611 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 610 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting Registry Extension Processing.
List of applicable Group Policy objects: (Changes were detected.)
Local Group Policy
| 4016 | 0 | | 4 | 0 | 1 | 4611686018427387904 | 609 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 608 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 607 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 606 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:32 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 605 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
Default Domain Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 604 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 603 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 602 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The system calls to access specified file completed.
\\cbci-845747-2.local\sysvol\cbci-845747-2.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini
The call completed in 16 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 601 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making system calls to access specified file.
\\cbci-845747-2.local\sysvol\cbci-845747-2.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini | 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 600 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A fast link was detected. The Estimated bandwidth is 26691 kbps. The slow link threshold is 500 kbps. | 5314 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 599 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Estimated network bandwidth on one of the connections: 3336378 kbps. | 5327 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 598 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting to download policies. | 4257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 597 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 596 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 595 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Account details:
Account Name : CN=N-H2-845747-2,CN=Computers,DC=cbci-845747-2,DC=local
Account Domain Name : cbci-845747-2.local
DC Name : \\n-ad-845747-2.cbci-845747-2.local
DC Domain Name : cbci-845747-2.local | 5310 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 594 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Computer details:
Computer role : 2
Network name : openstacklocal | 5309 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 593 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully discovered the Domain Controller in 16 milliseconds. | 5326 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 592 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Domain Controller details:
Domain Controller Name : n-ad-845747-2.cbci-845747-2.local
Domain Controller IP Address : 10.222.0.33 | 5308 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 591 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The LDAP call to connect and bind to Active Directory completed.
n-ad-845747-2.cbci-845747-2.local
The call completed in 16 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 590 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making LDAP calls to connect and bind to Active Directory.
n-ad-845747-2.cbci-845747-2.local | 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 589 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Retrieving Domain Controller details. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 588 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy is trying to discover the Domain Controller information. | 4326 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 587 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Retrieved account information. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 586 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The system call to get account information completed.
CN=N-H2-845747-2,CN=Computers,DC=cbci-845747-2,DC=local
The call completed in 0 milliseconds. | 5017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 585 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Making system call to get account information.
| 4017 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 584 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Attempting to retrieve the account information. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 583 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 582 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting computer boot policy processing for CBCI-845747-2\N-H2-845747-2$.
Activity id: {62974B09-034E-4F65-89E8-435A8FC01FD9} | 4000 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 581 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | 62974b09-034e-4f65-89e8-435a8fc01fd9 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy waited for 15 milliseconds for the network subsystem at computer boot. | 5322 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 580 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:31 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 579 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2808 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:30 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 578 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2804 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:30 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 577 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2324 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:30 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 576 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2324 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:30 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 575 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 2324 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:30 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: e0b204cb-5b84-4a6f-a8fe-eb8e0fb60729 | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 574 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 1872 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:30 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 573 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 1872 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:30 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 572 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 1872 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:30 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 571 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 1872 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:30 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 570 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 1872 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:29 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 569 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 1468 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:29 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 568 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1436 | 1468 | n-h2-845747-2.cbci-845747-2.local | S-1-5-18 | 6/17/2022 2:16:29 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service stopped. | 5115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 567 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 612 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 2:16:09 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received Preshutdown notification from Service Control Manager. | 5325 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 566 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 584 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 2:16:09 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 565 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 2760 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:12 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 564 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 2760 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:12 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 563 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:12 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed computer boot policy processing for WORKGROUP\N-H2-845747-2$ in 0 seconds. | 8000 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 562 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:12 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 561 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 2760 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed Registry Extension Processing in 16 milliseconds. | 5016 | 0 | | 4 | 0 | 2 | 4611686018427387904 | 560 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 559 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 2760 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 558 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 2760 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting Registry Extension Processing.
List of applicable Group Policy objects: (Changes were detected.)
Local Group Policy
| 4016 | 0 | | 4 | 0 | 1 | 4611686018427387904 | 557 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 556 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 555 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 554 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 553 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 552 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 551 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 550 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 549 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 548 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 547 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 2760 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 546 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 2760 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 545 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 2760 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 544 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting computer boot policy processing for WORKGROUP\N-H2-845747-2$.
Activity id: {C15762B3-9391-43AA-B50B-B6DA1B5BDF34} | 4000 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 543 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | c15762b3-9391-43aa-b50b-b6da1b5bdf34 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 542 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 3708 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 541 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 2760 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: 28cd1bc4-da1e-4f13-9510-42943f50b426 | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 540 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 544 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:00 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 539 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 544 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:00 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 538 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 544 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:00 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 537 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 544 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:00 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 536 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 544 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:00 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 535 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 2008 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:00 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 534 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 556 | 2008 | n-h2-845747-2 | S-1-5-18 | 6/17/2022 1:33:00 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service stopped. | 5115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 533 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 540 | 928 | WIN-5T344G8GM1H | S-1-5-18 | 6/17/2022 1:32:31 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received Preshutdown notification from Service Control Manager. | 5325 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 532 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 540 | 536 | WIN-5T344G8GM1H | S-1-5-18 | 6/17/2022 1:32:31 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: cf5d766a-dafc-4f5b-b30e-f7d12cdfdf41 | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 531 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 540 | 604 | WIN-5T344G8GM1H | S-1-5-18 | 6/17/2022 1:31:33 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 530 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 540 | 604 | WIN-5T344G8GM1H | S-1-5-18 | 6/17/2022 1:31:33 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 529 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 540 | 604 | WIN-5T344G8GM1H | S-1-5-18 | 6/17/2022 1:31:33 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 528 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 540 | 604 | WIN-5T344G8GM1H | S-1-5-18 | 6/17/2022 1:31:33 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 527 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 540 | 604 | WIN-5T344G8GM1H | S-1-5-18 | 6/17/2022 1:31:33 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 526 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 540 | 1524 | WIN-5T344G8GM1H | S-1-5-18 | 6/17/2022 1:31:33 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 525 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 540 | 1524 | WIN-5T344G8GM1H | S-1-5-18 | 6/17/2022 1:31:33 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service stopped. | 5115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 524 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 1440 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:48:13 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received Preshutdown notification from Service Control Manager. | 5325 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 523 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 980 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:48:13 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logoff from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 522 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 672 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:48:12 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification EndShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 521 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 3432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:48:12 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon Start Shell handling completed. | 6339 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 520 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 3048 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:33 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification StartShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 519 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 3048 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:33 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 518 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2072 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 517 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2072 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 516 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 523f618f-a541-4753-a681-3c0b79db800a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds. | 8001 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 515 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 523f618f-a541-4753-a681-3c0b79db800a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 514 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 523f618f-a541-4753-a681-3c0b79db800a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 513 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 523f618f-a541-4753-a681-3c0b79db800a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 512 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 523f618f-a541-4753-a681-3c0b79db800a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 511 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 523f618f-a541-4753-a681-3c0b79db800a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 510 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 523f618f-a541-4753-a681-3c0b79db800a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 509 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 9:41:32 AM | 523f618f-a541-4753-a681-3c0b79db800a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 508 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 9:41:32 AM | 523f618f-a541-4753-a681-3c0b79db800a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 507 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 9:41:32 AM | 523f618f-a541-4753-a681-3c0b79db800a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 506 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 9:41:32 AM | 523f618f-a541-4753-a681-3c0b79db800a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 505 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 523f618f-a541-4753-a681-3c0b79db800a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator.
Activity id: {523F618F-A541-4753-A681-3C0B79DB800A} | 4001 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 504 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 523f618f-a541-4753-a681-3c0b79db800a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 503 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 502 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2072 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 501 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2072 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 500 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2072 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 499 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2072 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed manual processing of policy for computer WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds. | 8004 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 498 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed Registry Extension Processing in 15 milliseconds. | 5016 | 0 | | 4 | 0 | 2 | 4611686018427387904 | 497 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting Registry Extension Processing.
List of applicable Group Policy objects: (Changes were detected.)
Local Group Policy
| 4016 | 0 | | 4 | 0 | 1 | 4611686018427387904 | 496 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 495 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 494 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 493 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 492 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 491 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 490 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 489 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 488 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 487 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Background. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 486 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting manual processing of policy for computer WORKGROUP\WIN-5T344G8GM1H$.
Activity id: {9663586B-26CE-4E7F-A115-7420EF71DDF6} | 4004 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 485 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2552 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:32 AM | 9663586b-26ce-4e7f-a115-7420ef71ddf6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 484 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | e1363503-0e2f-45f8-b60e-f5c745bc2310 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds. | 8000 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 483 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | e1363503-0e2f-45f8-b60e-f5c745bc2310 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 482 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | e1363503-0e2f-45f8-b60e-f5c745bc2310 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 481 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | e1363503-0e2f-45f8-b60e-f5c745bc2310 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 480 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | e1363503-0e2f-45f8-b60e-f5c745bc2310 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 479 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | e1363503-0e2f-45f8-b60e-f5c745bc2310 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 478 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | e1363503-0e2f-45f8-b60e-f5c745bc2310 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 477 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | e1363503-0e2f-45f8-b60e-f5c745bc2310 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 476 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | e1363503-0e2f-45f8-b60e-f5c745bc2310 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 475 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | e1363503-0e2f-45f8-b60e-f5c745bc2310 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 474 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | e1363503-0e2f-45f8-b60e-f5c745bc2310 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 473 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | e1363503-0e2f-45f8-b60e-f5c745bc2310 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$.
Activity id: {E1363503-0E2F-45F8-B60E-F5C745BC2310} | 4000 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 472 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | e1363503-0e2f-45f8-b60e-f5c745bc2310 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 471 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 470 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 1376 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 469 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 1376 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 468 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 1376 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:30 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: 17681e6a-4ec2-473c-afdb-140f3267c9cb | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 467 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 412 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:29 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 466 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 412 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:29 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 465 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 412 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:29 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 464 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 412 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:29 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 463 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 412 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:29 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 462 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 1240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:29 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 461 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 976 | 1240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:41:29 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service stopped. | 5115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 460 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2904 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:40:27 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received Preshutdown notification from Service Control Manager. | 5325 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 459 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 960 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:40:27 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logoff from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 458 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 1504 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:40:27 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification EndShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 457 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2760 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:40:27 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon Start Shell handling completed. | 6339 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 456 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2776 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:19 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification StartShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 455 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2776 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:19 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 454 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 453 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 452 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | 19830159-0802-4690-81df-314fc75bbec1 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds. | 8001 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 451 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | 19830159-0802-4690-81df-314fc75bbec1 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 450 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | 19830159-0802-4690-81df-314fc75bbec1 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 449 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | 19830159-0802-4690-81df-314fc75bbec1 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 448 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | 19830159-0802-4690-81df-314fc75bbec1 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 447 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | 19830159-0802-4690-81df-314fc75bbec1 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 446 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | 19830159-0802-4690-81df-314fc75bbec1 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 445 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 9:27:18 AM | 19830159-0802-4690-81df-314fc75bbec1 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 444 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 9:27:18 AM | 19830159-0802-4690-81df-314fc75bbec1 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 443 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 9:27:18 AM | 19830159-0802-4690-81df-314fc75bbec1 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 442 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 9:27:18 AM | 19830159-0802-4690-81df-314fc75bbec1 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 441 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | 19830159-0802-4690-81df-314fc75bbec1 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator.
Activity id: {19830159-0802-4690-81DF-314FC75BBEC1} | 4001 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 440 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | 19830159-0802-4690-81df-314fc75bbec1 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 439 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 438 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 372 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 437 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 436 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 435 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:18 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed manual processing of policy for computer WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds. | 8004 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 434 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed Registry Extension Processing in 32 milliseconds. | 5016 | 0 | | 4 | 0 | 2 | 4611686018427387904 | 433 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting Registry Extension Processing.
List of applicable Group Policy objects: (Changes were detected.)
Local Group Policy
| 4016 | 0 | | 4 | 0 | 1 | 4611686018427387904 | 432 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 431 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 430 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 429 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 428 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 427 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 426 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 425 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 424 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 423 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Background. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 422 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting manual processing of policy for computer WORKGROUP\WIN-5T344G8GM1H$.
Activity id: {96FB381F-0CD5-4B08-B375-7D41E6D4BD5A} | 4004 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 421 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | 96fb381f-0cd5-4b08-b375-7d41e6d4bd5a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 420 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 419 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 418 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds. | 8000 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 417 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed Registry Extension Processing in 16 milliseconds. | 5016 | 0 | | 4 | 0 | 2 | 4611686018427387904 | 416 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 415 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 414 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 413 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting Registry Extension Processing.
List of applicable Group Policy objects: (Changes were detected.)
Local Group Policy
| 4016 | 0 | | 4 | 0 | 1 | 4611686018427387904 | 412 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 411 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 410 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 409 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 408 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 407 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 406 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 405 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 404 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 403 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 402 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 401 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 400 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 399 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$.
Activity id: {FD8B735D-48A5-4AFF-82A0-4530749B9C93} | 4000 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 398 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | fd8b735d-48a5-4aff-82a0-4530749b9c93 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 397 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2948 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 396 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2624 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:17 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: 2aee4e0b-fb00-4527-adc4-e481e4d19dcd | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 395 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:15 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 394 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:15 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 393 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:15 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 392 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:15 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 391 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 432 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:15 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 390 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 1252 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:15 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 389 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 1252 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:27:15 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service stopped. | 5115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 388 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 968 | 3324 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:59 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received Preshutdown notification from Service Control Manager. | 5325 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 387 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 968 | 972 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:59 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: 3bfff0c0-0165-424d-b905-a307b3220abe | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 386 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 968 | 320 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:40 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 385 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 968 | 320 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:40 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 384 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 968 | 320 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:40 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 383 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 968 | 320 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:40 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 382 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 968 | 320 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:40 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 381 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 968 | 1240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:40 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 380 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 968 | 1240 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:40 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service stopped. | 5115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 379 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 3144 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:19 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received Preshutdown notification from Service Control Manager. | 5325 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 378 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 960 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:19 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logoff from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 377 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 1996 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:18 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification EndShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 376 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 404 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:26:18 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon Start Shell handling completed. | 6339 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 375 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:05 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification StartShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 374 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2512 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:05 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 373 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2780 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 372 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2780 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 371 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | 916d7bc6-7539-48f2-9f9e-92fdf76145fa | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds. | 8001 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 370 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | 916d7bc6-7539-48f2-9f9e-92fdf76145fa | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 369 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | 916d7bc6-7539-48f2-9f9e-92fdf76145fa | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 368 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | 916d7bc6-7539-48f2-9f9e-92fdf76145fa | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 367 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | 916d7bc6-7539-48f2-9f9e-92fdf76145fa | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 366 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | 916d7bc6-7539-48f2-9f9e-92fdf76145fa | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 365 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | 916d7bc6-7539-48f2-9f9e-92fdf76145fa | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 364 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 9:23:04 AM | 916d7bc6-7539-48f2-9f9e-92fdf76145fa | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 363 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 9:23:04 AM | 916d7bc6-7539-48f2-9f9e-92fdf76145fa | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 362 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 9:23:04 AM | 916d7bc6-7539-48f2-9f9e-92fdf76145fa | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 361 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 9:23:04 AM | 916d7bc6-7539-48f2-9f9e-92fdf76145fa | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 360 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | 916d7bc6-7539-48f2-9f9e-92fdf76145fa | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator.
Activity id: {916D7BC6-7539-48F2-9F9E-92FDF76145FA} | 4001 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 359 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | 916d7bc6-7539-48f2-9f9e-92fdf76145fa | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 358 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2780 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 357 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2116 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 356 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2780 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 355 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2780 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 354 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2780 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:04 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 353 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 724 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 352 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 724 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 351 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | fb64062e-023f-45c2-95f3-82a8fd38a036 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds. | 8000 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 350 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | fb64062e-023f-45c2-95f3-82a8fd38a036 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 349 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | fb64062e-023f-45c2-95f3-82a8fd38a036 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 348 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | fb64062e-023f-45c2-95f3-82a8fd38a036 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 347 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | fb64062e-023f-45c2-95f3-82a8fd38a036 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
Local Group Policy
Not Applied (Empty)
| 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 346 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | fb64062e-023f-45c2-95f3-82a8fd38a036 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
None | 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 345 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | fb64062e-023f-45c2-95f3-82a8fd38a036 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 344 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | fb64062e-023f-45c2-95f3-82a8fd38a036 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 343 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | fb64062e-023f-45c2-95f3-82a8fd38a036 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 342 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | fb64062e-023f-45c2-95f3-82a8fd38a036 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 341 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | fb64062e-023f-45c2-95f3-82a8fd38a036 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 340 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | fb64062e-023f-45c2-95f3-82a8fd38a036 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 339 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 724 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$.
Activity id: {FB64062E-023F-45C2-95F3-82A8FD38A036} | 4000 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 338 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | fb64062e-023f-45c2-95f3-82a8fd38a036 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 337 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 724 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 336 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 724 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 335 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 2964 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 334 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 724 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:03 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: 55f227a2-e54b-46f6-a36f-59838b5d3374 | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 333 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 724 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:00 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 332 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 724 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:00 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 331 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 724 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:00 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 330 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 724 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:00 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 329 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 724 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:00 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 328 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 1260 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:00 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 327 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 956 | 1260 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:23:00 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service stopped. | 5115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 326 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 3520 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:22:48 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received Preshutdown notification from Service Control Manager. | 5325 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 325 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1184 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:22:48 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logoff from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 324 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2516 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:22:48 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification EndShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 323 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2444 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 9:22:48 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon Start Shell handling completed. | 6339 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 322 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2044 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification StartShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 321 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2044 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 320 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2504 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 319 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2504 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 318 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | 16838b39-bd55-4d5f-a3e3-5d47a754deb8 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds. | 8001 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 317 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | 16838b39-bd55-4d5f-a3e3-5d47a754deb8 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 316 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | 16838b39-bd55-4d5f-a3e3-5d47a754deb8 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 315 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | 16838b39-bd55-4d5f-a3e3-5d47a754deb8 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 314 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | 16838b39-bd55-4d5f-a3e3-5d47a754deb8 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 313 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | 16838b39-bd55-4d5f-a3e3-5d47a754deb8 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 312 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | 16838b39-bd55-4d5f-a3e3-5d47a754deb8 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 311 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 8:54:50 AM | 16838b39-bd55-4d5f-a3e3-5d47a754deb8 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 310 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 8:54:50 AM | 16838b39-bd55-4d5f-a3e3-5d47a754deb8 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 309 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 8:54:50 AM | 16838b39-bd55-4d5f-a3e3-5d47a754deb8 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 308 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 8:54:50 AM | 16838b39-bd55-4d5f-a3e3-5d47a754deb8 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 307 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | 16838b39-bd55-4d5f-a3e3-5d47a754deb8 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator.
Activity id: {16838B39-BD55-4D5F-A3E3-5D47A754DEB8} | 4001 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 306 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | 16838b39-bd55-4d5f-a3e3-5d47a754deb8 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 305 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2504 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 304 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2804 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 303 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2504 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 302 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2504 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 301 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 2504 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:50 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 300 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | ef9dc327-237a-498f-a234-5dd260ac2188 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds. | 8000 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 299 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | ef9dc327-237a-498f-a234-5dd260ac2188 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 298 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | ef9dc327-237a-498f-a234-5dd260ac2188 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 297 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | ef9dc327-237a-498f-a234-5dd260ac2188 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 296 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | ef9dc327-237a-498f-a234-5dd260ac2188 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
Local Group Policy
Not Applied (Empty)
| 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 295 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | ef9dc327-237a-498f-a234-5dd260ac2188 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
None | 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 294 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | ef9dc327-237a-498f-a234-5dd260ac2188 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 293 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | ef9dc327-237a-498f-a234-5dd260ac2188 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 292 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | ef9dc327-237a-498f-a234-5dd260ac2188 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 291 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | ef9dc327-237a-498f-a234-5dd260ac2188 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 290 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | ef9dc327-237a-498f-a234-5dd260ac2188 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 289 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | ef9dc327-237a-498f-a234-5dd260ac2188 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$.
Activity id: {EF9DC327-237A-498F-A234-5DD260AC2188} | 4000 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 288 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | ef9dc327-237a-498f-a234-5dd260ac2188 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 287 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1420 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 286 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1420 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 285 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1832 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 284 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1420 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:49 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: 1bab69f4-e4b0-4881-969a-4be66736ab81 | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 283 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:48 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 282 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:48 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 281 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:48 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 280 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:48 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 279 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1284 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:48 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 278 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1232 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:48 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 277 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1180 | 1232 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:48 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service stopped. | 5115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 276 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 3720 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:39 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received Preshutdown notification from Service Control Manager. | 5325 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 275 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 1196 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:39 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logoff from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 274 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2632 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:39 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification EndShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 273 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2652 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:54:39 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon Start Shell handling completed. | 6339 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 272 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 1484 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:56 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification StartShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 271 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 1484 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:56 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 270 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2632 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 269 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2632 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 268 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | 45025c4d-6f9d-4b05-92b5-93a82391a3de | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds. | 8001 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 267 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | 45025c4d-6f9d-4b05-92b5-93a82391a3de | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 266 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | 45025c4d-6f9d-4b05-92b5-93a82391a3de | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 265 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | 45025c4d-6f9d-4b05-92b5-93a82391a3de | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 264 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | 45025c4d-6f9d-4b05-92b5-93a82391a3de | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 263 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | 45025c4d-6f9d-4b05-92b5-93a82391a3de | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 262 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | 45025c4d-6f9d-4b05-92b5-93a82391a3de | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 261 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 8:50:55 AM | 45025c4d-6f9d-4b05-92b5-93a82391a3de | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 260 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 8:50:55 AM | 45025c4d-6f9d-4b05-92b5-93a82391a3de | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 259 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 8:50:55 AM | 45025c4d-6f9d-4b05-92b5-93a82391a3de | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 258 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 8:50:55 AM | 45025c4d-6f9d-4b05-92b5-93a82391a3de | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 257 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | 45025c4d-6f9d-4b05-92b5-93a82391a3de | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator.
Activity id: {45025C4D-6F9D-4B05-92B5-93A82391A3DE} | 4001 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 256 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | 45025c4d-6f9d-4b05-92b5-93a82391a3de | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 255 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2632 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 254 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2816 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 253 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2632 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 252 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2632 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 251 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2632 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 250 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2632 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 249 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2632 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 248 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | a33a2b8c-390a-413d-8b21-12f16046f44f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds. | 8000 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 247 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | a33a2b8c-390a-413d-8b21-12f16046f44f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 246 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | a33a2b8c-390a-413d-8b21-12f16046f44f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 245 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | a33a2b8c-390a-413d-8b21-12f16046f44f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 244 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | a33a2b8c-390a-413d-8b21-12f16046f44f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
Local Group Policy
Not Applied (Empty)
| 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 243 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | a33a2b8c-390a-413d-8b21-12f16046f44f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
None | 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 242 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | a33a2b8c-390a-413d-8b21-12f16046f44f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 241 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | a33a2b8c-390a-413d-8b21-12f16046f44f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 240 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | a33a2b8c-390a-413d-8b21-12f16046f44f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 239 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | a33a2b8c-390a-413d-8b21-12f16046f44f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 238 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | a33a2b8c-390a-413d-8b21-12f16046f44f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 237 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | a33a2b8c-390a-413d-8b21-12f16046f44f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$.
Activity id: {A33A2B8C-390A-413D-8B21-12F16046F44F} | 4000 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 236 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | a33a2b8c-390a-413d-8b21-12f16046f44f | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 235 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2632 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 234 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2632 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 233 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2632 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 232 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2128 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 231 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 2632 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:54 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: c59c478f-2ba4-4b8b-9216-af0e61f55471 | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 230 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 1412 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:02 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 229 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 1412 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:02 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 228 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 1412 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:02 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 227 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 1412 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:02 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 226 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 1412 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:02 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 225 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 1288 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:02 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 224 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1192 | 1288 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:50:02 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service stopped. | 5115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 223 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 772 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:45:57 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received Preshutdown notification from Service Control Manager. | 5325 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 222 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 968 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:45:57 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logoff from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 221 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 1824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:45:56 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification EndShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 220 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 1904 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:45:56 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon Start Shell handling completed. | 6339 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 219 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 1564 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification StartShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 218 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 1564 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 217 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2404 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 216 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2404 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 215 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | 65cb5132-e893-416b-a63d-2ba652d6d6c6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds. | 8001 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 214 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | 65cb5132-e893-416b-a63d-2ba652d6d6c6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 213 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | 65cb5132-e893-416b-a63d-2ba652d6d6c6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 212 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | 65cb5132-e893-416b-a63d-2ba652d6d6c6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 211 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | 65cb5132-e893-416b-a63d-2ba652d6d6c6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 210 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | 65cb5132-e893-416b-a63d-2ba652d6d6c6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 209 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | 65cb5132-e893-416b-a63d-2ba652d6d6c6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 208 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 8:24:01 AM | 65cb5132-e893-416b-a63d-2ba652d6d6c6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 207 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 8:24:01 AM | 65cb5132-e893-416b-a63d-2ba652d6d6c6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 206 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 8:24:01 AM | 65cb5132-e893-416b-a63d-2ba652d6d6c6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 205 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/19/2018 8:24:01 AM | 65cb5132-e893-416b-a63d-2ba652d6d6c6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 204 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | 65cb5132-e893-416b-a63d-2ba652d6d6c6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator.
Activity id: {65CB5132-E893-416B-A63D-2BA652D6D6C6} | 4001 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 203 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | 65cb5132-e893-416b-a63d-2ba652d6d6c6 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 202 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2404 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 201 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 3028 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 200 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2404 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 199 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2404 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 198 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2404 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:01 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 197 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds. | 8000 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 196 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 195 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 194 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 193 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
Local Group Policy
Not Applied (Empty)
| 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 192 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
None | 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 191 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 190 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 189 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 188 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 187 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 186 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2316 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 185 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2316 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 184 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$.
Activity id: {ED5A8EC3-2E31-4880-B3CC-3D038F81C4A4} | 4000 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 183 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | ed5a8ec3-2e31-4880-b3cc-3d038f81c4a4 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 182 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2824 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 181 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 2316 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:24:00 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: 7ec6f95f-ca51-46fd-b628-91606dc57360 | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 180 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 88 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:23:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 179 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 88 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:23:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 178 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 88 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:23:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 177 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 88 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:23:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 176 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 88 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:23:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 175 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 1176 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:23:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 174 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 964 | 1176 | WIN-5T344G8GM1H | S-1-5-18 | 1/19/2018 8:23:55 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service stopped. | 5115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 173 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1664 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:44:38 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received Preshutdown notification from Service Control Manager. | 5325 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 172 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1180 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:44:38 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logoff from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 171 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 3168 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:44:38 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification EndShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 170 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1724 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:44:38 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon Start Shell handling completed. | 6339 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 169 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2384 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification StartShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 168 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2384 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 167 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 166 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 165 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | f99ea46f-75fc-4ce4-8726-97fc03d1b568 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds. | 8001 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 164 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | f99ea46f-75fc-4ce4-8726-97fc03d1b568 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 163 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | f99ea46f-75fc-4ce4-8726-97fc03d1b568 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 162 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | f99ea46f-75fc-4ce4-8726-97fc03d1b568 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 161 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | f99ea46f-75fc-4ce4-8726-97fc03d1b568 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 160 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | f99ea46f-75fc-4ce4-8726-97fc03d1b568 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 159 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | f99ea46f-75fc-4ce4-8726-97fc03d1b568 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 158 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/16/2018 6:07:02 PM | f99ea46f-75fc-4ce4-8726-97fc03d1b568 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 157 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/16/2018 6:07:02 PM | f99ea46f-75fc-4ce4-8726-97fc03d1b568 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 156 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/16/2018 6:07:02 PM | f99ea46f-75fc-4ce4-8726-97fc03d1b568 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 155 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/16/2018 6:07:02 PM | f99ea46f-75fc-4ce4-8726-97fc03d1b568 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 154 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | f99ea46f-75fc-4ce4-8726-97fc03d1b568 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator.
Activity id: {F99EA46F-75FC-4CE4-8726-97FC03D1B568} | 4001 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 153 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | f99ea46f-75fc-4ce4-8726-97fc03d1b568 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 152 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 151 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1692 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 150 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 149 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 148 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2580 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:02 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 147 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 146 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 145 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | fa8f8e72-590e-4ae5-9c6c-7d5c9f473623 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds. | 8000 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 144 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | fa8f8e72-590e-4ae5-9c6c-7d5c9f473623 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 143 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | fa8f8e72-590e-4ae5-9c6c-7d5c9f473623 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 142 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | fa8f8e72-590e-4ae5-9c6c-7d5c9f473623 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 141 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | fa8f8e72-590e-4ae5-9c6c-7d5c9f473623 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
Local Group Policy
Not Applied (Empty)
| 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 140 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | fa8f8e72-590e-4ae5-9c6c-7d5c9f473623 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
None | 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 139 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | fa8f8e72-590e-4ae5-9c6c-7d5c9f473623 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 138 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | fa8f8e72-590e-4ae5-9c6c-7d5c9f473623 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 137 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | fa8f8e72-590e-4ae5-9c6c-7d5c9f473623 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 136 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | fa8f8e72-590e-4ae5-9c6c-7d5c9f473623 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 135 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | fa8f8e72-590e-4ae5-9c6c-7d5c9f473623 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 134 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 133 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | fa8f8e72-590e-4ae5-9c6c-7d5c9f473623 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$.
Activity id: {FA8F8E72-590E-4AE5-9C6C-7D5C9F473623} | 4000 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 132 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | fa8f8e72-590e-4ae5-9c6c-7d5c9f473623 | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 131 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 130 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 129 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2728 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 128 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 2640 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:07:01 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: 3b55a67b-bb51-4c33-a51f-c935146e1612 | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 127 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1392 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:24 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 126 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1392 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:24 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 125 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1392 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:24 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 124 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1392 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:24 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 123 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1392 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:24 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 122 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1316 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:24 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 121 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1176 | 1316 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:06:24 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service stopped. | 5115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 120 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3660 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:02:38 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received Preshutdown notification from Service Control Manager. | 5325 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 119 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 1156 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:02:38 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logoff from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 118 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 5108 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:02:38 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification EndShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 117 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 5108 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 6:02:38 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon Start Shell handling completed. | 6339 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 116 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:07 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification StartShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 115 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2472 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:07 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 114 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2600 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 113 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2600 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 112 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds. | 8001 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 111 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 110 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 109 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 108 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 107 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 106 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 105 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/16/2018 5:43:06 PM | b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 104 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/16/2018 5:43:06 PM | b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 103 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/16/2018 5:43:06 PM | b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 102 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/16/2018 5:43:06 PM | b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 101 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator.
Activity id: {B40A7D2E-EE0B-4AFD-8EF4-53A4B91BD98D} | 4001 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 100 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | b40a7d2e-ee0b-4afd-8ef4-53a4b91bd98d | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 99 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2600 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 98 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2784 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 97 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2600 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 96 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2600 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 95 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2600 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:06 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 94 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2400 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 93 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2400 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 92 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | 280da8c2-eac4-4740-9f29-d442b4641cda | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds. | 8000 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 91 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | 280da8c2-eac4-4740-9f29-d442b4641cda | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 90 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | 280da8c2-eac4-4740-9f29-d442b4641cda | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 89 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | 280da8c2-eac4-4740-9f29-d442b4641cda | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 88 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | 280da8c2-eac4-4740-9f29-d442b4641cda | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
Local Group Policy
Not Applied (Empty)
| 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 87 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | 280da8c2-eac4-4740-9f29-d442b4641cda | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
None | 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 86 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | 280da8c2-eac4-4740-9f29-d442b4641cda | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 85 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | 280da8c2-eac4-4740-9f29-d442b4641cda | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 84 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2400 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 83 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | 280da8c2-eac4-4740-9f29-d442b4641cda | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 82 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | 280da8c2-eac4-4740-9f29-d442b4641cda | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 81 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2400 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 80 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2400 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 79 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | 280da8c2-eac4-4740-9f29-d442b4641cda | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 78 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | 280da8c2-eac4-4740-9f29-d442b4641cda | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$.
Activity id: {280DA8C2-EAC4-4740-9F29-D442B4641CDA} | 4000 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 77 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | 280da8c2-eac4-4740-9f29-d442b4641cda | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 76 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 3056 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 75 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 2400 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:43:05 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: ad8eaacf-9ac8-4b59-9d35-13bd21983404 | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 74 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 1364 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 73 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 1364 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 72 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 1364 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 71 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 1364 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 70 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 1364 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 69 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 1276 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 68 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 1152 | 1276 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:42:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service stopped. | 5115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 67 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 6040 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:35:50 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received Preshutdown notification from Service Control Manager. | 5325 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 66 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 928 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:35:50 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logoff from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 65 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1564 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:35:49 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification EndShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 64 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 932 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:35:49 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon Start Shell handling completed. | 6339 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 63 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 2368 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification StartShell from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 62 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 2368 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 61 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1948 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 60 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1948 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 59 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed user logon policy processing for WIN-5T344G8GM1H\Administrator in 0 seconds. | 8001 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 58 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed Registry Extension Processing in 16 milliseconds. | 5016 | 0 | | 4 | 0 | 2 | 4611686018427387904 | 57 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 56 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1948 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 55 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1948 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 54 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1948 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting Registry Extension Processing.
List of applicable Group Policy objects: (Changes were detected.)
Local Group Policy
| 4016 | 0 | | 4 | 0 | 1 | 4611686018427387904 | 53 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 52 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 51 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 50 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
None | 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 49 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
Local Group Policy
| 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 48 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 47 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 46 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 45 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 44 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-21-416071247-492812682-1642729393-500 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 43 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting user logon Policy processing for WIN-5T344G8GM1H\Administrator.
Activity id: {822AD6C6-A4A6-4A78-B264-65E46A20EFBB} | 4001 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 42 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | 822ad6c6-a4a6-4a78-b264-65e46a20efbb | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 41 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1948 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 40 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3756 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 39 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1948 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 38 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1948 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification Logon from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 37 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1948 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:11 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session completed successfully. | 5117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 36 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | 227ceb83-33cd-4922-aed0-d222bc464b1a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 35 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 2872 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 34 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 2872 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Completed computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$ in 0 seconds. | 8000 | 1 | | 4 | 0 | 2 | 4611686018427387904 | 33 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | 227ceb83-33cd-4922-aed0-d222bc464b1a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Stop | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Finished checking for non-system extensions. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 32 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | 227ceb83-33cd-4922-aed0-d222bc464b1a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Service configuration update to standalone is not required and will be skipped. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 31 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | 227ceb83-33cd-4922-aed0-d222bc464b1a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Checking for Group Policy client extensions that are not part of the system. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 30 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | 227ceb83-33cd-4922-aed0-d222bc464b1a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The following Group Policy objects were not applicable because they were filtered out :
Local Group Policy
Not Applied (Empty)
| 5313 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 29 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | 227ceb83-33cd-4922-aed0-d222bc464b1a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
List of applicable Group Policy objects:
None | 5312 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 28 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | 227ceb83-33cd-4922-aed0-d222bc464b1a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy successfully got applicable GPOs from the domain controller. | 5126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 27 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | 227ceb83-33cd-4922-aed0-d222bc464b1a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed downloading policies. | 5257 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 26 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | 227ceb83-33cd-4922-aed0-d222bc464b1a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy receiving applicable GPOs from the domain controller. | 4126 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 25 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | 227ceb83-33cd-4922-aed0-d222bc464b1a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The loopback policy processing mode is "No loopback mode". | 5311 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 24 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | 227ceb83-33cd-4922-aed0-d222bc464b1a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 23 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 2872 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy processing mode is Foreground synchronous. | 5340 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 22 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | 227ceb83-33cd-4922-aed0-d222bc464b1a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Starting computer boot policy processing for WORKGROUP\WIN-5T344G8GM1H$.
Activity id: {227CEB83-33CD-4922-AED0-D222BC464B1A} | 4000 | 1 | | 4 | 0 | 1 | 4611686018427387904 | 21 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | 227ceb83-33cd-4922-aed0-d222bc464b1a | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Start | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group policy session returned to winlogon. | 5351 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 20 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1948 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Winlogon status reporting has completed. | 6338 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 19 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1948 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Session started. | 4117 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 18 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 3492 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received the notification CreateSession from Winlogon for session 1. | 5324 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 17 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1948 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:02:09 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: 3dbc3a1f-1e0f-497f-bf39-81527fa03b67 | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 16 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1532 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:01:59 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 15 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1532 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:01:59 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 14 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1532 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:01:59 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 13 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1532 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:01:59 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 12 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1532 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:01:58 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 11 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1732 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:01:58 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 10 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 924 | 1732 | WIN-5T344G8GM1H | S-1-5-18 | 1/16/2018 5:01:58 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service stopped. | 5115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 9 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 916 | 2760 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 9:01:40 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy received Preshutdown notification from Service Control Manager. | 5325 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 8 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 916 | 920 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 9:01:40 AM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A previous instance of the Group Policy Client Service was detected. Parameter: e9a66211-b3b2-4290-a071-282831c76b8b | 5321 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 7 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 916 | 944 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:14 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing service instance state to detect previous instances of the service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 6 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 916 | 944 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:14 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Initializing and reading current service configuration for the Group Policy Client service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 5 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 916 | 944 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:14 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
The Group Policy Client service is currently configured as a shared service. | 5320 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 4 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 916 | 944 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:14 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Successfully completed the Group Policy Service initialization phase. | 5116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 3 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 916 | 944 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:14 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Group Policy Service started. | 4115 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 2 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 916 | 1452 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:14 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
Started the Group Policy service initialization phase. | 4116 | 0 | | 4 | 0 | 0 | 4611686018427387904 | 1 | Microsoft-Windows-GroupPolicy | aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 | Microsoft-Windows-GroupPolicy/Operational | 916 | 1452 | WIN-PD8DQPRRTAO | S-1-5-18 | 1/16/2018 5:01:14 PM | | | microsoft-windows-grouppolicy/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |