Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	157	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1716	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:35:26 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	156	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1376	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:35:11 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	155	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4676	4852	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:35:06 PM	df40b157-bb1a-0001-cabf-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	154	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4676	4852	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:35:06 PM	df40b157-bb1a-0001-cabf-40df1abbd801	df40b157-bb1a-0001-ccbf-40df1abbd801	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	153	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4676	3996	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:35:06 PM	df40b157-bb1a-0001-ccbf-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	152	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4676	4852	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:35:06 PM	df40b157-bb1a-0001-cabf-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	151	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4676	3996	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:35:06 PM	df40b157-bb1a-0001-cabf-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	150	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1372	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:35:02 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	149	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	916	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:31:22 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	148	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1372	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:31:21 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	147	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1372	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:31:16 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	146	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1708	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:31:11 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	145	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1372	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:30:23 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	144	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	2836	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:30:19 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	143	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	2836	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:29:55 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	142	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1708	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:29:43 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	141	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	916	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:29:38 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	140	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	2836	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:29:32 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	139	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	2836	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:24:59 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	138	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1376	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:24:54 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	137	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1372	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:24:52 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	136	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1712	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:22:36 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	135	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1372	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:22:32 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	134	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1372	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:22:31 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	133	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1372	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:22:28 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	132	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	916	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:22:25 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	131	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1708	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:22:24 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	130	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1712	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:22:22 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	129	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1708	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:22:19 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	128	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1372	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:22:13 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	127	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	916	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:22:10 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	126	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1712	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:22:09 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	125	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	916	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:22:05 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	124	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	916	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:22:03 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	123	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	916	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:21:12 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	122	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1376	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:21:07 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	121	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	916	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:21:05 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	120	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1988	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:21:00 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	119	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1712	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:20:39 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	118	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	2836	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:20:35 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	117	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1708	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:20:32 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	116	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1376	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:20:30 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	115	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1376	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:19:29 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	114	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1712	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:19:27 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	113	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1708	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:19:25 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	112	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	916	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:19:23 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	111	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1712	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:19:19 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	110	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	916	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:19:16 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	109	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	916	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:19:14 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	108	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1988	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:19:09 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	107	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1728	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:19:00 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	106	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1724	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:18:57 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	105	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1728	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:18:55 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	104	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1724	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:18:53 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	103	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1988	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:18:42 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	102	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1776	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:18:33 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	101	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1728	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:18:27 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	100	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1716	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:18:09 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	99	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1728	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:18:05 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	98	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1716	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:18:01 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	97	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1872	832	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:17:57 PM	df40b157-bb1a-0003-edb2-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	96	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1872	832	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:17:57 PM	df40b157-bb1a-0003-edb2-40df1abbd801	df40b157-bb1a-0003-f0b2-40df1abbd801	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	95	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1872	2520	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:17:57 PM	df40b157-bb1a-0003-f0b2-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	94	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1872	4004	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:17:57 PM	df40b157-bb1a-0003-edb2-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	93	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1872	2520	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:17:57 PM	df40b157-bb1a-0003-edb2-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	92	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1728	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:17:42 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	91	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	1716	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1001	8/28/2022 8:16:53 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create completed successfully	132	0		4	10	2	4611686018427387906	90	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	3564	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:34 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/certmapping	145	0		4	5	1	4611686018427387906	89	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	1152	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:34 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get failed, error code 2150858752	142	0		2	10	2	4611686018427387906	88	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	1028	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:34 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/certmapping	145	0		4	5	1	4611686018427387906	87	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	1152	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:34 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put completed successfully	132	0		4	10	2	4611686018427387906	86	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	3568	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:34 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	85	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	1152	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:34 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get completed successfully	132	0		4	10	2	4611686018427387906	84	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	3568	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:34 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	83	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	1152	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:34 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get completed successfully	132	0		4	10	2	4611686018427387906	82	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	1028	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:34 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	81	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	1152	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:34 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create completed successfully	132	0		4	10	2	4611686018427387906	80	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	1028	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:34 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	79	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	1152	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:33 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get failed, error code 2150858752	142	0		2	10	2	4611686018427387906	78	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	896	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:33 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	77	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	1152	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:33 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put completed successfully	132	0		4	10	2	4611686018427387906	76	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	868	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:33 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	75	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	1152	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:33 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get completed successfully	132	0		4	10	2	4611686018427387906	74	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	896	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:33 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	73	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1156	1152	n-h2-854615-3	S-1-5-21-4216810021-772517261-228190859-1000	8/28/2022 8:16:33 PM	df40b157-bb1a-0004-d5b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	72	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	2420	n-h2-854615-3	S-1-5-20	8/28/2022 8:15:33 PM	df40b157-bb1a-0005-86b1-40df1abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	71	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1336	2420	n-h2-854615-3	S-1-5-20	8/28/2022 8:15:33 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	70	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1716	1784	n-h2-854615-3	S-1-5-20	8/28/2022 8:14:52 PM	92847a1b-bb1a-0000-4c7a-84921abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	69	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1716	1784	WIN-5T344G8GM1H	S-1-5-20	8/28/2022 8:14:52 PM	92847a1b-bb1a-0000-4c7a-84921abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	68	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1716	2164	WIN-5T344G8GM1H	S-1-5-20	8/28/2022 8:13:38 PM	92847a1b-bb1a-0000-4c7a-84921abbd801		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	67	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1716	2164	WIN-5T344G8GM1H	S-1-5-20	8/28/2022 8:13:38 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	66	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	1500	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:48:13 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	65	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	1500	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:48:13 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Invoke completed successfully	132	0		4	10	2	4611686018427387906	64	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4104	3660	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:42:51 AM	ad8d0f9c-9109-0003-3f12-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Invoke started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/service	145	0		4	5	1	4611686018427387906	63	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4104	3176	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:42:51 AM	ad8d0f9c-9109-0003-3f12-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	62	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	2176	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:30 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	61	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	2176	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:30 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	60	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	3416	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:15 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	59	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	3416	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:15 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	58	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2212	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:16 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	57	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2212	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:16 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	56	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2004	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:00 AM	96ed06e7-9107-0002-2807-ed960791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	55	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2004	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:00 AM	96ed06e7-9107-0002-2807-ed960791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	54	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2284	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:41 AM	96ed06e7-9107-0002-2807-ed960791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	53	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2284	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:41 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	52	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	1192	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:23 AM	17f2f0cc-9107-0000-03f1-f2170791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	51	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	1192	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:23 AM	17f2f0cc-9107-0000-03f1-f2170791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	50	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	2152	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:01 AM	17f2f0cc-9107-0000-03f1-f2170791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	49	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	2152	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:01 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	48	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	3948	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:22:50 AM	289cfce6-9103-0003-08fd-9c280391d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	47	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	3948	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:22:50 AM	289cfce6-9103-0003-08fd-9c280391d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	46	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	2148	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:49 AM	289cfce6-9103-0003-08fd-9c280391d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	45	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	2148	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:49 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	44	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	1916	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:40 AM	7c5c4ffb-9102-0002-1f50-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	43	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	1916	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:40 AM	7c5c4ffb-9102-0002-1f50-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	42	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	2028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	41	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	3004	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	40	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	39	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	3004	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	38	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2156	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:50:03 AM	7c5c4ffb-9102-0002-1f50-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	37	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2156	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:50:03 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	36	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	2544	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:49:46 AM	9a81cb05-910f-0003-3ccb-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	35	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	2544	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:49:46 AM	9a81cb05-910f-0003-3ccb-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	34	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	5108	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	33	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	4228	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	32	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	2904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	31	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	4228	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	30	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	1772	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:23:56 AM	9a81cb05-910f-0003-3ccb-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	29	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	1772	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:23:56 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	28	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:44:39 PM	b65c0852-8ef4-0001-7408-5cb6f48ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	27	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:44:39 PM	b65c0852-8ef4-0001-7408-5cb6f48ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	26	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1464	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:25 PM	b65c0852-8ef4-0001-7408-5cb6f48ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	25	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1464	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:24 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	24	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	1792	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:09 PM	53b2b737-8ef1-0002-53b7-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	23	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	1792	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:09 PM	53b2b737-8ef1-0002-53b7-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	22	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	2472	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	21	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	4780	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	20	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	2624	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	19	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	4780	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	18	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	2064	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:42:11 PM	53b2b737-8ef1-0002-53b7-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	17	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	2064	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:42:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	16	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	1660	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:41:56 PM	a4626349-8ea8-0002-0e64-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	15	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	1660	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:41:55 PM	a4626349-8ea8-0002-0e64-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	14	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	1564	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	13	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	3696	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	12	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	2368	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	11	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	3696	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	10	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	2888	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	9	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	1992	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	8	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	2480	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	7	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	1992	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	6	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	2088	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:01:59 PM	a4626349-8ea8-0002-0e64-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	5	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	2088	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:01:59 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	4	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM	60e27e42-8f3f-0001-c27e-e2603f8fd301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	3	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM	60e27e42-8f3f-0001-c27e-e2603f8fd301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM service is unable to start because of a failure during initialization. The error code is 2	210	0		2	11	2	4611686018427387908	2	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM	60e27e42-8f3f-0001-c27e-e2603f8fd301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	1	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]