Message | Id | Version | Qualifiers | Level | Task | Opcode | Keywords | RecordId | ProviderName | ProviderId | LogName | ProcessId | ThreadId | MachineName | UserId | TimeCreated | ActivityId | RelatedActivityId | ContainerLog | MatchedQueryIds | Bookmark | LevelDisplayName | OpcodeDisplayName | TaskDisplayName | KeywordsDisplayNames | Properties |
A Terminal Services session change was processed.
Reason: A session was connected to the console terminal | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 156 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1964 | 2040 | n-h2-851359-11.cbci-851359-11.local | S-1-5-19 | 8/24/2022 6:49:04 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {DD9DAC49-AFBB-4E56-A2DA-2DE1D076D752}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 155 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1964 | 2040 | n-h2-851359-11.cbci-851359-11.local | S-1-5-19 | 8/24/2022 6:48:59 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {DD9DAC49-AFBB-4E56-A2DA-2DE1D076D752}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 154 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1964 | 2040 | n-h2-851359-11.cbci-851359-11.local | S-1-5-19 | 8/24/2022 6:48:59 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 153 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1964 | 2012 | n-h2-851359-11.cbci-851359-11.local | S-1-5-19 | 8/24/2022 6:48:59 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {BEDA5789-663B-49F7-972B-EA95F3F2A2FF}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 152 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1964 | 2040 | n-h2-851359-11.cbci-851359-11.local | S-1-5-19 | 8/24/2022 6:48:59 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 151 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1964 | 2012 | n-h2-851359-11.cbci-851359-11.local | S-1-5-19 | 8/24/2022 6:48:59 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {BEDA5789-663B-49F7-972B-EA95F3F2A2FF}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 150 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1964 | 2040 | n-h2-851359-11.cbci-851359-11.local | S-1-5-19 | 8/24/2022 6:48:59 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 149 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1964 | 2012 | n-h2-851359-11.cbci-851359-11.local | S-1-5-19 | 8/24/2022 6:48:59 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete Service Shutdown | 10004 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 148 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2108 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:48:37 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientUnregister - Status [0x0] | 4028 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 147 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2108 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:48:36 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start Service Shutdown | 10003 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 146 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2108 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:48:36 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {DD9DAC49-AFBB-4E56-A2DA-2DE1D076D752}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 145 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2096 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:04:25 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {DD9DAC49-AFBB-4E56-A2DA-2DE1D076D752}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 144 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2096 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:04:25 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter removal
Interface: {DD9DAC49-AFBB-4E56-A2DA-2DE1D076D752}
Type: Ethernet. | 1010 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 143 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2096 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:04:25 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter removal
Interface: {DD9DAC49-AFBB-4E56-A2DA-2DE1D076D752}
Type: Ethernet. | 1027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 142 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2096 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:04:25 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A session was connected to the console terminal | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 141 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2096 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:02:21 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {BEDA5789-663B-49F7-972B-EA95F3F2A2FF}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 140 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2096 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:02:05 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {BEDA5789-663B-49F7-972B-EA95F3F2A2FF}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 139 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2096 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:02:05 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 138 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2088 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:02:05 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 137 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2088 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:02:05 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {DD9DAC49-AFBB-4E56-A2DA-2DE1D076D752}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 136 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2096 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:02:05 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {DD9DAC49-AFBB-4E56-A2DA-2DE1D076D752}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 135 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2096 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:02:05 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 134 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 2068 | 2088 | n-h2-851359-11 | S-1-5-19 | 8/24/2022 6:02:05 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete Service Shutdown | 10004 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 133 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1840 | 1896 | WIN-5T344G8GM1H | S-1-5-19 | 8/24/2022 6:01:29 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientUnregister - Status [0x0] | 4028 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 132 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1840 | 1896 | WIN-5T344G8GM1H | S-1-5-19 | 8/24/2022 6:01:29 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start Service Shutdown | 10003 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 131 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1840 | 1896 | WIN-5T344G8GM1H | S-1-5-19 | 8/24/2022 6:01:29 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCM Preferred Order List:
0: {BEDA5789-663B-49F7-972B-EA95F3F2A2FF}, beda5789-663b-49f7-972b-ea95f3f2a2ff, 1
1: {DD9DAC49-AFBB-4E56-A2DA-2DE1D076D752}, dd9dac49-afbb-4e56-a2da-2de1d076d752, 1
2: {518CDFA4-5492-4D9E-BEAA-908825A4A289}, 518cdfa4-5492-4d9e-beaa-908825a4a289, 1
3: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}, 5c5d9a3a-40d7-47b4-b915-59c9831563df, 1
| 1020 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 130 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1840 | 1880 | WIN-5T344G8GM1H | S-1-5-19 | 8/24/2022 6:00:08 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {BEDA5789-663B-49F7-972B-EA95F3F2A2FF}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 129 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1840 | 1880 | WIN-5T344G8GM1H | S-1-5-19 | 8/24/2022 6:00:08 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {BEDA5789-663B-49F7-972B-EA95F3F2A2FF}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 128 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1840 | 1880 | WIN-5T344G8GM1H | S-1-5-19 | 8/24/2022 6:00:08 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCM Preferred Order List:
0: {DD9DAC49-AFBB-4E56-A2DA-2DE1D076D752}, dd9dac49-afbb-4e56-a2da-2de1d076d752, 1
1: {518CDFA4-5492-4D9E-BEAA-908825A4A289}, 518cdfa4-5492-4d9e-beaa-908825a4a289, 1
2: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}, 5c5d9a3a-40d7-47b4-b915-59c9831563df, 1
| 1020 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 127 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1840 | 1880 | WIN-5T344G8GM1H | S-1-5-19 | 8/24/2022 6:00:08 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 126 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1840 | 1860 | WIN-5T344G8GM1H | S-1-5-19 | 8/24/2022 6:00:08 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {DD9DAC49-AFBB-4E56-A2DA-2DE1D076D752}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 125 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1840 | 1880 | WIN-5T344G8GM1H | S-1-5-19 | 8/24/2022 6:00:08 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 124 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1840 | 1860 | WIN-5T344G8GM1H | S-1-5-19 | 8/24/2022 6:00:08 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {DD9DAC49-AFBB-4E56-A2DA-2DE1D076D752}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 123 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1840 | 1880 | WIN-5T344G8GM1H | S-1-5-19 | 8/24/2022 6:00:08 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 122 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1840 | 1860 | WIN-5T344G8GM1H | S-1-5-19 | 8/24/2022 6:00:08 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete Service Shutdown | 10004 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 121 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1724 | 1892 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:48:13 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientUnregister - Status [0x0] | 4028 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 120 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1724 | 1892 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:48:13 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start Service Shutdown | 10003 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 119 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1724 | 1892 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:48:13 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged off the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 118 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1724 | 1816 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:48:12 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged on to the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 117 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1724 | 1816 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:41:33 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A session was connected to the console terminal | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 116 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1724 | 1816 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:41:30 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 115 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1724 | 1792 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:41:30 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 114 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1724 | 1792 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:41:30 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 113 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1724 | 1816 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:41:30 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 112 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1724 | 1816 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:41:30 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 111 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1724 | 1792 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:41:29 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete Service Shutdown | 10004 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 110 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1532 | 1640 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:41:15 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientUnregister - Status [0x0] | 4028 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 109 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1532 | 1640 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:41:15 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start Service Shutdown | 10003 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 108 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1532 | 1640 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:41:15 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged off the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 107 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1532 | 1624 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:40:27 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged on to the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 106 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1532 | 1624 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:27:19 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A session was connected to the console terminal | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 105 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1532 | 1624 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:27:17 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 104 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1532 | 1604 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:27:15 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 103 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1532 | 1624 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:27:15 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 102 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1532 | 1624 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:27:15 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 101 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1532 | 1604 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:27:15 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 100 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1532 | 1604 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:27:15 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete Service Shutdown | 10004 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 99 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1420 | 1556 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:27:00 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientUnregister - Status [0x0] | 4028 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 98 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1420 | 1556 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:27:00 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start Service Shutdown | 10003 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 97 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1420 | 1556 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:27:00 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 96 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1420 | 1492 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:26:40 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 95 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1420 | 1540 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:26:40 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 94 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1420 | 1540 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:26:40 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 93 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1420 | 1492 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:26:40 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 92 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1420 | 1492 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:26:40 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete Service Shutdown | 10004 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 91 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1472 | 1692 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:26:23 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientUnregister - Status [0x0] | 4028 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 90 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1472 | 1692 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:26:23 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start Service Shutdown | 10003 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 89 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1472 | 1692 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:26:23 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged off the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 88 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1472 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:26:19 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged on to the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 87 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1472 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:23:05 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A session was connected to the console terminal | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 86 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1472 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:23:03 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 85 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1472 | 1528 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:23:00 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 84 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1472 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:23:00 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 83 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1472 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:23:00 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 82 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1472 | 1528 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:23:00 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 81 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1472 | 1528 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:23:00 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete Service Shutdown | 10004 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 80 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1648 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:22:50 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientUnregister - Status [0x0] | 4028 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 79 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1648 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:22:50 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start Service Shutdown | 10003 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 78 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1648 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:22:50 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged off the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 77 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1636 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:22:48 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 76 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1636 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:19:17 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 75 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1636 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:19:17 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter removal
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1010 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 74 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1636 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:19:16 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter removal
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 73 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1636 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 9:19:16 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged on to the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 72 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1636 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:50 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A session was connected to the console terminal | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 71 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1636 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:49 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 70 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1620 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:48 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 69 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1620 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:48 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 68 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1636 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:48 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 67 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1636 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:48 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 66 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1436 | 1620 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:48 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete Service Shutdown | 10004 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 65 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1512 | 1700 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:40 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientUnregister - Status [0x0] | 4028 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 64 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1512 | 1700 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:40 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start Service Shutdown | 10003 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 63 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1512 | 1700 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:40 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged off the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 62 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1512 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:54:39 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged on to the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 61 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1512 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:50:56 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A session was connected to the console terminal | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 60 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1512 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:50:54 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 59 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1512 | 1648 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:50:02 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 58 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1512 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:50:02 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 57 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1512 | 1648 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:50:02 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 56 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1512 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:50:02 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 55 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1512 | 1648 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:50:02 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete Service Shutdown | 10004 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 54 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1324 | 1452 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:49:46 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientUnregister - Status [0x0] | 4028 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 53 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1324 | 1452 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:49:46 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start Service Shutdown | 10003 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 52 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1324 | 1452 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:49:46 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged off the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 51 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1324 | 1440 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:45:56 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged on to the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 50 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1324 | 1440 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:24:01 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A session was connected to the console terminal | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 49 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1324 | 1440 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:24:00 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCM Preferred Order List:
0: {518CDFA4-5492-4D9E-BEAA-908825A4A289}, 518cdfa4-5492-4d9e-beaa-908825a4a289, 1
1: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}, 5c5d9a3a-40d7-47b4-b915-59c9831563df, 1
| 1020 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 48 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1324 | 1440 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:23:57 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 47 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1324 | 1440 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:23:57 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {518CDFA4-5492-4D9E-BEAA-908825A4A289}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 46 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1324 | 1440 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:23:57 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 45 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1324 | 1388 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:23:55 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 44 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1324 | 1388 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:23:55 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 43 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1324 | 1388 | WIN-5T344G8GM1H | S-1-5-19 | 1/19/2018 8:23:55 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete Service Shutdown | 10004 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 42 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1396 | 1712 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:44:39 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientUnregister - Status [0x0] | 4028 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 41 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1396 | 1712 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:44:39 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start Service Shutdown | 10003 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 40 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1396 | 1712 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:44:39 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged off the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 39 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1396 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:44:38 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged on to the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 38 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1396 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:07:02 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A session was connected to the console terminal | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 37 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1396 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:07:01 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 36 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1396 | 1620 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:06:24 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 35 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1396 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:06:24 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 34 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1396 | 1688 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:06:24 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 33 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1396 | 1620 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:06:24 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 32 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1396 | 1620 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:06:24 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete Service Shutdown | 10004 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 31 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1408 | 1728 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:06:09 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientUnregister - Status [0x0] | 4028 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 30 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1408 | 1728 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:06:09 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start Service Shutdown | 10003 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 29 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1408 | 1728 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:06:09 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged off the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 28 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1408 | 1700 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 6:02:38 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged on to the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 27 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1408 | 1700 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:43:07 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A session was connected to the console terminal | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 26 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1408 | 1700 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:43:05 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 25 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1408 | 1668 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:42:11 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 24 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1408 | 1700 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:42:11 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 23 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1408 | 1700 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:42:11 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 22 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1408 | 1668 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:42:11 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 21 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1408 | 1668 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:42:11 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete Service Shutdown | 10004 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 20 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1896 | 1944 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:41:55 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientUnregister - Status [0x0] | 4028 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 19 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1896 | 1944 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:41:55 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start Service Shutdown | 10003 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 18 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1896 | 1944 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:41:55 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged off the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 17 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1896 | 1932 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:35:49 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A user has logged on to the session | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 16 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1896 | 1932 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:02:11 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
A Terminal Services session change was processed.
Reason: A session was connected to the console terminal | 1006 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 15 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1896 | 1932 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:02:09 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 14 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1896 | 1920 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:01:59 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 13 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1896 | 1920 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:01:59 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 12 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1896 | 1932 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:01:59 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 11 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1896 | 1932 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:01:59 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 10 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1896 | 1920 | WIN-5T344G8GM1H | S-1-5-19 | 1/16/2018 5:01:58 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete Service Shutdown | 10004 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 9 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1636 | 1712 | WIN-PD8DQPRRTAO | S-1-5-19 | 1/16/2018 9:01:42 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientUnregister - Status [0x0] | 4028 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 8 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1636 | 1712 | WIN-PD8DQPRRTAO | S-1-5-19 | 1/16/2018 9:01:42 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start Service Shutdown | 10003 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 7 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1636 | 1712 | WIN-PD8DQPRRTAO | S-1-5-19 | 1/16/2018 9:01:42 AM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCM Preferred Order List:
0: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}, 5c5d9a3a-40d7-47b4-b915-59c9831563df, 1
| 1020 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 6 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1636 | 1704 | WIN-PD8DQPRRTAO | S-1-5-19 | 1/16/2018 5:01:21 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an L2 adapter arrival
Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}
Type: Ethernet. | 1009 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 5 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1636 | 1704 | WIN-PD8DQPRRTAO | S-1-5-19 | 1/16/2018 5:01:21 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
CDE reported an NDIS adapter arrival
Interface: {5C5D9A3A-40D7-47B4-B915-59C9831563DF}
Type: Ethernet. | 1026 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 4 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1636 | 1704 | WIN-PD8DQPRRTAO | S-1-5-19 | 1/16/2018 5:01:21 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Complete WCM Service Startup | 10002 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 3 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1636 | 1684 | WIN-PD8DQPRRTAO | S-1-5-19 | 1/16/2018 5:01:14 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WcmSvc CmPdcActivationClientRegister - Status [0x0] | 4027 | 0 | | 4 | 0 | 0 | -9223372036854775776 | 2 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1636 | 1684 | WIN-PD8DQPRRTAO | S-1-5-19 | 1/16/2018 5:01:14 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |
WCMSVC: Start WCM Service Startup | 10001 | 0 | | 4 | 0 | 0 | -9223372036854775808 | 1 | Microsoft-Windows-Wcmsvc | 67d07935-283a-4791-8f8d-fa9117f3e6f2 | Microsoft-Windows-Wcmsvc/Operational | 1636 | 1684 | WIN-PD8DQPRRTAO | S-1-5-19 | 1/16/2018 5:01:14 PM | | | microsoft-windows-wcmsvc/operational | System.UInt32[] | System.Diagnostics.Eventing.Reader.EventBookmark | Information | Info | | System.Collections.ObjectModel.ReadOnlyCollection`1[System.String] | System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty] |