Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
User "CBCI-854030-3\N-H2-854030-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	94	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 11:43:10 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-854030-3\N-H2-854030-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	93	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 11:13:10 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{EF31E196-A3A6-4C6E-91C6-026D19676D40}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	92	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2460	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:52:40 PM	ef31e196-a3a6-4c6e-91c6-026d19676d40		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Autochk\Proxy" , instance "{EF31E196-A3A6-4C6E-91C6-026D19676D40}" , action "%windir%\system32\rundll32.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	91	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2460	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:52:40 PM	ef31e196-a3a6-4c6e-91c6-026d19676d40		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\rundll32.exe" in instance "{EF31E196-A3A6-4C6E-91C6-026D19676D40}" of task "\Microsoft\Windows\Autochk\Proxy".	200	1		4	200	1	-9223372036854775808	90	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2460	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:52:40 PM	ef31e196-a3a6-4c6e-91c6-026d19676d40		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{EF31E196-A3A6-4C6E-91C6-026D19676D40}" instance of the "\Microsoft\Windows\Autochk\Proxy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	89	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2460	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:52:40 PM	ef31e196-a3a6-4c6e-91c6-026d19676d40		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Autochk\Proxy" , instance "%windir%\system32\rundll32.exe" with process ID 1120.	129	0		4	129	0	-9223372036854775808	88	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2460	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:52:40 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{EF31E196-A3A6-4C6E-91C6-026D19676D40}" instance of task "\Microsoft\Windows\Autochk\Proxy" due to system startup.	118	0		4	118	0	-9223372036854775808	87	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2460	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:52:40 PM	ef31e196-a3a6-4c6e-91c6-026d19676d40		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-854030-3\N-H2-854030-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	86	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2976	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:43:10 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "NT AUTHORITY\SYSTEM" updated Task Scheduler task "\Microsoft\Windows\WindowsUpdate\Scheduled Start"	140	0		4	140	0	-9223372036854775808	85	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2392	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:36:50 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{A2F925F9-A083-4AA0-85D3-2830B5AE213F}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	84	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2392	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:22:39 PM	a2f925f9-a083-4aa0-85d3-2830b5ae213f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "{A2F925F9-A083-4AA0-85D3-2830B5AE213F}" , action "%windir%\System32\XblGameSaveTask.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	83	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2392	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:22:39 PM	a2f925f9-a083-4aa0-85d3-2830b5ae213f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\System32\XblGameSaveTask.exe" in instance "{A2F925F9-A083-4AA0-85D3-2830B5AE213F}" of task "\Microsoft\XblGameSave\XblGameSaveTask".	200	1		4	200	1	-9223372036854775808	82	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:22:39 PM	a2f925f9-a083-4aa0-85d3-2830b5ae213f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{A2F925F9-A083-4AA0-85D3-2830B5AE213F}" instance of the "\Microsoft\XblGameSave\XblGameSaveTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	81	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:22:39 PM	a2f925f9-a083-4aa0-85d3-2830b5ae213f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\XblGameSave\XblGameSaveTask" , instance "%windir%\System32\XblGameSaveTask.exe" with process ID 4812.	129	0		4	129	0	-9223372036854775808	80	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:22:39 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" disabled Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	142	0		4	142	0	-9223372036854775808	79	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:39 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task disabled	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{1D94BC39-7502-464F-A712-6C96D5042037}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	78	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:39 PM	1d94bc39-7502-464f-a712-6c96d5042037		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "{1D94BC39-7502-464F-A712-6C96D5042037}" , action "%windir%\system32\wermgr.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	77	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:39 PM	1d94bc39-7502-464f-a712-6c96d5042037		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-854030-3\N-H2-854030-3$" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan"	140	0		4	140	0	-9223372036854775808	76	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:39 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{17F68CC8-F9CB-4A1B-9D88-8A4FE12E7791}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	75	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:39 PM	17f68cc8-f9cb-4a1b-9d88-8a4fe12e7791		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "{17F68CC8-F9CB-4A1B-9D88-8A4FE12E7791}" , action "%systemroot%\system32\usoclient.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	74	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:39 PM	17f68cc8-f9cb-4a1b-9d88-8a4fe12e7791		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "System" updated Task Scheduler task "\Microsoft\Windows\UpdateOrchestrator\Resume On Boot"	140	0		4	140	0	-9223372036854775808	73	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2460	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:39 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\wermgr.exe" in instance "{1D94BC39-7502-464F-A712-6C96D5042037}" of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting".	200	1		4	200	1	-9223372036854775808	72	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2460	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:39 PM	1d94bc39-7502-464f-a712-6c96d5042037		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{1D94BC39-7502-464F-A712-6C96D5042037}" instance of the "\Microsoft\Windows\Windows Error Reporting\QueueReporting" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	71	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2460	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:39 PM	1d94bc39-7502-464f-a712-6c96d5042037		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" , instance "%windir%\system32\wermgr.exe" with process ID 3268.	129	0		4	129	0	-9223372036854775808	70	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2460	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:39 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{1D94BC39-7502-464F-A712-6C96D5042037}" instance of task "\Microsoft\Windows\Windows Error Reporting\QueueReporting" due to system startup.	118	0		4	118	0	-9223372036854775808	69	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2460	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:39 PM	1d94bc39-7502-464f-a712-6c96d5042037		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\usoclient.exe" in instance "{17F68CC8-F9CB-4A1B-9D88-8A4FE12E7791}" of task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan".	200	1		4	200	1	-9223372036854775808	68	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:38 PM	17f68cc8-f9cb-4a1b-9d88-8a4fe12e7791		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{17F68CC8-F9CB-4A1B-9D88-8A4FE12E7791}" instance of the "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	67	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:38 PM	17f68cc8-f9cb-4a1b-9d88-8a4fe12e7791		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" , instance "%systemroot%\system32\usoclient.exe" with process ID 3008.	129	0		4	129	0	-9223372036854775808	66	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:38 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler could not launch task "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" as scheduled. Instance "{17F68CC8-F9CB-4A1B-9D88-8A4FE12E7791}" is started now as required by the configuration option to start the task when available, if schedule is missed.	114	0		3	114	0	-9223372036854775808	65	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:38 PM	17f68cc8-f9cb-4a1b-9d88-8a4fe12e7791		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Missed task started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-854030-3\N-H2-854030-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	64	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2948	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:15:11 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{74128A4E-431C-4910-8B2F-5D8AF5DE2B27}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	63	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	3016	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:14:27 PM	74128a4e-431c-4910-8b2f-5d8af5de2b27		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "{74128A4E-431C-4910-8B2F-5D8AF5DE2B27}" , action "%windir%\system32\compattelrunner.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	62	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	3016	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:14:27 PM	74128a4e-431c-4910-8b2f-5d8af5de2b27		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{CB309B0C-1F6C-43A1-9022-3C006B856524}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	61	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1628	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:41 PM	cb309b0c-1f6c-43a1-9022-3c006b856524		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "{CB309B0C-1F6C-43A1-9022-3C006B856524}" , action "%systemroot%\system32\cmd.exe" with return code 0.	201	2		4	201	2	-9223372036854775808	60	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1628	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:41 PM	cb309b0c-1f6c-43a1-9022-3c006b856524		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%systemroot%\system32\cmd.exe" in instance "{CB309B0C-1F6C-43A1-9022-3C006B856524}" of task "\Microsoft\Windows\Software Inventory Logging\Configuration".	200	1		4	200	1	-9223372036854775808	59	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:39 PM	cb309b0c-1f6c-43a1-9022-3c006b856524		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{CB309B0C-1F6C-43A1-9022-3C006B856524}" instance of the "\Microsoft\Windows\Software Inventory Logging\Configuration" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	58	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:39 PM	cb309b0c-1f6c-43a1-9022-3c006b856524		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Software Inventory Logging\Configuration" , instance "%systemroot%\system32\cmd.exe" with process ID 4480.	129	0		4	129	0	-9223372036854775808	57	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:39 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{CB309B0C-1F6C-43A1-9022-3C006B856524}" instance of task "\Microsoft\Windows\Software Inventory Logging\Configuration" due to system startup.	118	0		4	118	0	-9223372036854775808	56	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:39 PM	cb309b0c-1f6c-43a1-9022-3c006b856524		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
User "CBCI-854030-3\N-H2-854030-3$" updated Task Scheduler task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"	140	0		4	140	0	-9223372036854775808	55	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1628	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:21 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task registration updated	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{21E80F2E-5E66-4F82-BDEF-8F9A6C83BF49}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	54	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1628	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM	21e80f2e-5e66-4f82-bdef-8f9a6c83bf49		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{21E80F2E-5E66-4F82-BDEF-8F9A6C83BF49}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	53	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1628	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM	21e80f2e-5e66-4f82-bdef-8f9a6c83bf49		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{21E80F2E-5E66-4F82-BDEF-8F9A6C83BF49}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	52	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1628	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM	21e80f2e-5e66-4f82-bdef-8f9a6c83bf49		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{21E80F2E-5E66-4F82-BDEF-8F9A6C83BF49}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	51	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1628	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM	21e80f2e-5e66-4f82-bdef-8f9a6c83bf49		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 3768.	129	0		4	129	0	-9223372036854775808	50	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1628	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{3C569EDE-ACA4-4BE0-A636-D98DAF39244A}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	49	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1884	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM	3c569ede-aca4-4be0-a636-d98daf39244a		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{3C569EDE-ACA4-4BE0-A636-D98DAF39244A}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	48	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1884	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM	3c569ede-aca4-4be0-a636-d98daf39244a		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{A0C8659B-84F2-4F8C-9498-23AA2C456AF3}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	47	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1884	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM	a0c8659b-84f2-4f8c-9498-23aa2c456af3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{A0C8659B-84F2-4F8C-9498-23AA2C456AF3}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	46	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1884	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM	a0c8659b-84f2-4f8c-9498-23aa2c456af3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{A0C8659B-84F2-4F8C-9498-23AA2C456AF3}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	45	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1884	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM	a0c8659b-84f2-4f8c-9498-23aa2c456af3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{A0C8659B-84F2-4F8C-9498-23AA2C456AF3}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	44	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1884	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM	a0c8659b-84f2-4f8c-9498-23aa2c456af3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{3C569EDE-ACA4-4BE0-A636-D98DAF39244A}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	43	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM	3c569ede-aca4-4be0-a636-d98daf39244a		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{3C569EDE-ACA4-4BE0-A636-D98DAF39244A}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	42	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM	3c569ede-aca4-4be0-a636-d98daf39244a		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 2412.	129	0		4	129	0	-9223372036854775808	41	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:18 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{7ED089EE-1FC0-42DA-A49B-7A4F1F8DC5C2}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	40	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM	7ed089ee-1fc0-42da-a49b-7a4f1f8dc5c2		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{7ED089EE-1FC0-42DA-A49B-7A4F1F8DC5C2}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	39	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM	7ed089ee-1fc0-42da-a49b-7a4f1f8dc5c2		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{7ED089EE-1FC0-42DA-A49B-7A4F1F8DC5C2}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	38	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM	7ed089ee-1fc0-42da-a49b-7a4f1f8dc5c2		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{7ED089EE-1FC0-42DA-A49B-7A4F1F8DC5C2}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	37	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM	7ed089ee-1fc0-42da-a49b-7a4f1f8dc5c2		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 5112.	129	0		4	129	0	-9223372036854775808	36	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{539AAB33-C48D-4F03-A24A-27DFCDA8F226}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	35	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2948	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM	539aab33-c48d-4f03-a24a-27dfcda8f226		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{539AAB33-C48D-4F03-A24A-27DFCDA8F226}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	34	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2948	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM	539aab33-c48d-4f03-a24a-27dfcda8f226		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{9B94A508-4018-4AB1-B5E3-821A08B7C942}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	33	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2948	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM	9b94a508-4018-4ab1-b5e3-821a08b7c942		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{9B94A508-4018-4AB1-B5E3-821A08B7C942}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	32	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2948	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM	9b94a508-4018-4ab1-b5e3-821a08b7c942		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{9B94A508-4018-4AB1-B5E3-821A08B7C942}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	31	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1628	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM	9b94a508-4018-4ab1-b5e3-821a08b7c942		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{9B94A508-4018-4AB1-B5E3-821A08B7C942}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	30	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1628	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM	9b94a508-4018-4ab1-b5e3-821a08b7c942		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{539AAB33-C48D-4F03-A24A-27DFCDA8F226}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	29	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM	539aab33-c48d-4f03-a24a-27dfcda8f226		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{539AAB33-C48D-4F03-A24A-27DFCDA8F226}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	28	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM	539aab33-c48d-4f03-a24a-27dfcda8f226		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "taskhostw.exe" with process ID 5048.	129	0		4	129	0	-9223372036854775808	27	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:13:08 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{732E4C50-C569-4202-A849-553FB8EB36EE}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	26	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:54 PM	732e4c50-c569-4202-a849-553fb8eb36ee		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{732E4C50-C569-4202-A849-553FB8EB36EE}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	25	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:54 PM	732e4c50-c569-4202-a849-553fb8eb36ee		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{B13BC1D7-80E7-42FE-9FA1-43C8FCC92E25}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	24	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:52 PM	b13bc1d7-80e7-42fe-9fa1-43c8fcc92e25		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\CertificateServicesClient\SystemTask" , instance "{B13BC1D7-80E7-42FE-9FA1-43C8FCC92E25}" , action "Certificate Services Client Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	23	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:52 PM	b13bc1d7-80e7-42fe-9fa1-43c8fcc92e25		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{50F54142-8B5C-4D65-B56E-D014B9ABC464}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	22	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:52 PM	50f54142-8b5c-4d65-b56e-d014b9abc464		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{50F54142-8B5C-4D65-B56E-D014B9ABC464}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	21	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:52 PM	50f54142-8b5c-4d65-b56e-d014b9abc464		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{2A757E49-702B-41CE-A79D-849ACFFA1DC3}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	20	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:52 PM	2a757e49-702b-41ce-a79d-849acffa1dc3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\Plug and Play\Device Install Group Policy" , instance "{2A757E49-702B-41CE-A79D-849ACFFA1DC3}" , action "Device Installation Group Policy Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	19	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:52 PM	2a757e49-702b-41ce-a79d-849acffa1dc3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{50F54142-8B5C-4D65-B56E-D014B9ABC464}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	18	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2256	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:52 PM	50f54142-8b5c-4d65-b56e-d014b9abc464		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{50F54142-8B5C-4D65-B56E-D014B9ABC464}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	17	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2256	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:52 PM	50f54142-8b5c-4d65-b56e-d014b9abc464		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully finished "{A26C7EEB-9B6A-48DB-8F71-022EEC10BF3F}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	102	0		4	102	2	-9223372036854775807	16	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:52 PM	a26c7eeb-9b6a-48db-8f71-022eec10bf3f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Task completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler successfully completed task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "{A26C7EEB-9B6A-48DB-8F71-022EEC10BF3F}" , action "TPM Maintenance Task Handler" with return code 0.	201	2		4	201	2	-9223372036854775808	15	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1796	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:52 PM	a26c7eeb-9b6a-48db-8f71-022eec10bf3f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Action completed	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{B13BC1D7-80E7-42FE-9FA1-43C8FCC92E25}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	14	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:49 PM	b13bc1d7-80e7-42fe-9fa1-43c8fcc92e25		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{B13BC1D7-80E7-42FE-9FA1-43C8FCC92E25}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	13	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:49 PM	b13bc1d7-80e7-42fe-9fa1-43c8fcc92e25		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched "{B13BC1D7-80E7-42FE-9FA1-43C8FCC92E25}" instance of task "\Microsoft\Windows\CertificateServicesClient\SystemTask" due to system startup.	118	0		4	118	0	-9223372036854775808	12	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:49 PM	b13bc1d7-80e7-42fe-9fa1-43c8fcc92e25		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Task triggered by computer startup	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler queued instance "{50F54142-8B5C-4D65-B56E-D014B9ABC464}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance" and will launch it as soon as instance "{A26C7EEB-9B6A-48DB-8F71-022EEC10BF3F}" completes.	324	0		3	324	0	-9223372036854775808	11	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2324	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:44 PM	50f54142-8b5c-4d65-b56e-d014b9abc464		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Warning	Info	Launch request queued, instance already running	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Device Installation Group Policy Task Handler" in instance "{2A757E49-702B-41CE-A79D-849ACFFA1DC3}" of task "\Microsoft\Windows\Plug and Play\Device Install Group Policy".	200	1		4	200	1	-9223372036854775808	10	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:44 PM	2a757e49-702b-41ce-a79d-849acffa1dc3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{2A757E49-702B-41CE-A79D-849ACFFA1DC3}" instance of the "\Microsoft\Windows\Plug and Play\Device Install Group Policy" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	9	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2420	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:44 PM	2a757e49-702b-41ce-a79d-849acffa1dc3		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "Certificate Services Client Task Handler" in instance "{732E4C50-C569-4202-A849-553FB8EB36EE}" of task "\Microsoft\Windows\CertificateServicesClient\SystemTask".	200	1		4	200	1	-9223372036854775808	8	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1628	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:44 PM	732e4c50-c569-4202-a849-553fb8eb36ee		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{732E4C50-C569-4202-A849-553FB8EB36EE}" instance of the "\Microsoft\Windows\CertificateServicesClient\SystemTask" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	7	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	1628	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:44 PM	732e4c50-c569-4202-a849-553fb8eb36ee		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "%windir%\system32\compattelrunner.exe" in instance "{74128A4E-431C-4910-8B2F-5D8AF5DE2B27}" of task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser".	200	1		4	200	1	-9223372036854775808	6	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2812	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:40 PM	74128a4e-431c-4910-8b2f-5d8af5de2b27		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{74128A4E-431C-4910-8B2F-5D8AF5DE2B27}" instance of the "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	5	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2812	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:40 PM	74128a4e-431c-4910-8b2f-5d8af5de2b27		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" , instance "%windir%\system32\compattelrunner.exe" with process ID 3136.	129	0		4	129	0	-9223372036854775808	4	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2812	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:40 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launched action "TPM Maintenance Task Handler" in instance "{A26C7EEB-9B6A-48DB-8F71-022EEC10BF3F}" of task "\Microsoft\Windows\TPM\Tpm-Maintenance".	200	1		4	200	1	-9223372036854775808	3	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2812	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:40 PM	a26c7eeb-9b6a-48db-8f71-022eec10bf3f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Action started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler started "{A26C7EEB-9B6A-48DB-8F71-022EEC10BF3F}" instance of the "\Microsoft\Windows\TPM\Tpm-Maintenance" task for user "NT AUTHORITY\SYSTEM".	100	0		4	100	1	-9223372036854775807	2	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2812	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:40 PM	a26c7eeb-9b6a-48db-8f71-022eec10bf3f		microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Task Started	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Task Scheduler launch task "\Microsoft\Windows\TPM\Tpm-Maintenance" , instance "taskhostw.exe" with process ID 3112.	129	0		4	129	0	-9223372036854775808	1	Microsoft-Windows-TaskScheduler	de7b24ea-73c8-4a09-985d-5bdadcfa9017	Microsoft-Windows-TaskScheduler/Operational	1392	2812	n-h2-854030-3.cbci-854030-3.local	S-1-5-18	9/1/2022 10:12:40 PM			microsoft-windows-taskscheduler/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Created Task Process	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]