Message	Id	Version	Qualifiers	Level	Task	Opcode	Keywords	RecordId	ProviderName	ProviderId	LogName	ProcessId	ThreadId	MachineName	UserId	TimeCreated	ActivityId	RelatedActivityId	ContainerLog	MatchedQueryIds	Bookmark	LevelDisplayName	OpcodeDisplayName	TaskDisplayName	KeywordsDisplayNames	Properties
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	340	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1636	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:33:24 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	339	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1724	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:33:12 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	338	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2108	384	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:33:09 AM	d15b2ed5-3eec-0005-b2c1-5dd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	337	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2108	384	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:33:09 AM	d15b2ed5-3eec-0005-b2c1-5dd1ec3ed701	d15b2ed5-3eec-0005-b4c1-5dd1ec3ed701	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	336	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2108	4212	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:33:09 AM	d15b2ed5-3eec-0005-b4c1-5dd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	335	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2108	804	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:33:09 AM	d15b2ed5-3eec-0005-b2c1-5dd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	334	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2108	4212	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:33:09 AM	d15b2ed5-3eec-0005-b2c1-5dd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	333	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1728	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:33:05 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	332	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:41 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	331	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:41 AM	d15b2ed5-3eec-0001-0a94-5cd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	330	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:41 AM	d15b2ed5-3eec-0001-0a94-5cd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	329	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4544	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:41 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	328	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:41 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	327	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:39 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	326	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:39 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	325	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:39 AM	d15b2ed5-3eec-0000-5f6b-5cd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	324	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:39 AM	d15b2ed5-3eec-0000-5f6b-5cd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	323	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	8	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:39 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	322	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:39 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	321	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:39 AM	d15b2ed5-3eec-0003-66b7-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	320	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:39 AM	d15b2ed5-3eec-0003-66b7-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	319	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4304	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:39 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	318	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:39 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	317	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:34 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	316	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:34 AM	d15b2ed5-3eec-0002-74ad-5dd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	315	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:34 AM	d15b2ed5-3eec-0002-74ad-5dd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	314	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4448	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:34 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	313	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:34 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	312	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:33 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	311	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:32 AM	d15b2ed5-3eec-0005-24c0-5dd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	310	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:32 AM	d15b2ed5-3eec-0005-24c0-5dd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	309	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:32 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	308	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:32 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	307	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:31 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	306	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:31 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	305	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:31 AM	d15b2ed5-3eec-0003-20b7-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	304	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:31 AM	d15b2ed5-3eec-0003-20b7-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	303	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1088	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:31 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	302	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:31 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	301	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:31 AM	d15b2ed5-3eec-0004-d899-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	300	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:31 AM	d15b2ed5-3eec-0004-d899-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	299	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4160	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:31 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	298	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:32:31 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	297	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:30:42 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	296	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:30:42 AM	d15b2ed5-3eec-0003-df94-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	295	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:30:42 AM	d15b2ed5-3eec-0003-df94-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	294	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1088	hv-osbrick-7805	S-1-5-18	5/2/2021 1:30:42 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	293	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:30:42 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	292	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:28:45 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	291	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:28:45 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	290	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:28:45 AM	d15b2ed5-3eec-0001-b87c-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	289	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:28:45 AM	d15b2ed5-3eec-0001-b87c-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	288	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	552	hv-osbrick-7805	S-1-5-18	5/2/2021 1:28:45 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	287	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:28:45 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	286	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:28:45 AM	d15b2ed5-3eec-0004-326d-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	285	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:28:45 AM	d15b2ed5-3eec-0004-326d-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	284	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3300	hv-osbrick-7805	S-1-5-18	5/2/2021 1:28:45 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	283	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:28:45 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	282	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	281	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM	d15b2ed5-3eec-0004-c15d-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	280	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM	d15b2ed5-3eec-0004-c15d-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	279	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	278	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	277	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	276	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	275	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM	d15b2ed5-3eec-0001-b969-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	274	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM	d15b2ed5-3eec-0001-b969-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	273	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1088	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	272	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	271	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM	d15b2ed5-3eec-0004-a95d-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	270	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM	d15b2ed5-3eec-0004-a95d-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	269	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4160	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	268	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:09 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	267	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:04 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	266	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:04 AM	d15b2ed5-3eec-0005-9491-5cd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	265	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:04 AM	d15b2ed5-3eec-0005-9491-5cd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	264	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3300	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:04 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	263	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:04 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	262	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	261	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM	d15b2ed5-3eec-0003-de65-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	260	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM	d15b2ed5-3eec-0003-de65-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	259	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	2848	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	258	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	257	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	256	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	255	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM	d15b2ed5-3eec-0004-e159-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	254	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM	d15b2ed5-3eec-0004-e159-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	253	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3176	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	252	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	251	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM	d15b2ed5-3eec-0000-b94b-5cd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	250	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM	d15b2ed5-3eec-0000-b94b-5cd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	249	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4364	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	248	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:26:03 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	247	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:54 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	246	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:54 AM	d15b2ed5-3eec-0004-6652-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	245	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1100	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:54 AM	d15b2ed5-3eec-0004-6652-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	244	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	552	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:54 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	243	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:54 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	242	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:53 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	241	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:53 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	240	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:53 AM	d15b2ed5-3eec-0000-2c4a-5cd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	239	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:53 AM	d15b2ed5-3eec-0000-2c4a-5cd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	238	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3300	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:53 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	237	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:53 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	236	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:53 AM	d15b2ed5-3eec-0001-1662-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	235	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:53 AM	d15b2ed5-3eec-0001-1662-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	234	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	2848	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:53 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	233	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:53 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	232	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:44 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	231	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:43 AM	d15b2ed5-3eec-0002-09c3-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	230	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3216	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:43 AM	d15b2ed5-3eec-0002-09c3-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	229	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	8	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:43 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	228	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:43 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	227	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:01 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	226	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:01 AM	d15b2ed5-3eec-0003-c84a-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	225	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:01 AM	d15b2ed5-3eec-0003-c84a-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	224	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1088	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:01 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	223	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:01 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	222	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:00 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	221	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:00 AM	d15b2ed5-3eec-0004-9446-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	220	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:00 AM	d15b2ed5-3eec-0004-9446-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Snapshot under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	219	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4160	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:00 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	218	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:25:00 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	217	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	216	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM	d15b2ed5-3eec-0005-ac9c-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	215	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM	d15b2ed5-3eec-0005-ac9c-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	214	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4264	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	213	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	212	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	211	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	210	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM	d15b2ed5-3eec-0004-7a46-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	209	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	3124	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM	d15b2ed5-3eec-0004-7a46-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Host under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	208	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4304	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	207	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	206	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM	d15b2ed5-3eec-0004-6c46-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	205	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM	d15b2ed5-3eec-0004-6c46-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_IDMethod under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	204	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4880	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	203	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:59 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler closed the session.	45	0		4	15	2	4611686018427387906	202	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:39 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session successfully completed the operation.	48	0		4	16	2	4611686018427387906	201	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:39 AM	d15b2ed5-3eec-0003-7249-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Delete completed successfully	132	0		4	10	2	4611686018427387906	200	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	744	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:39 AM	d15b2ed5-3eec-0003-7249-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol session began an operation of type DeleteInstance to the server. The operation accesses class WT_Disk under the root/wmi namespace.	47	0		4	16	1	4611686018427387906	199	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	1260	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:39 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Operation	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler started to create a session at the following destination: ..	44	0		4	15	1	4611686018427387906	198	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:39 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Session	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM protocol handler has began loading for application <none>.	41	0		4	14	1	4611686018427387906	197	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2252	4452	hv-osbrick-7805	S-1-5-18	5/2/2021 1:24:39 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WinRM MI Protocol Handler	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	196	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1724	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:37 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	195	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:35 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	194	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1356	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:32 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	193	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:30 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	192	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1356	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:28 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	191	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:25 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	190	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1712	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:23 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	189	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:21 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	188	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1348	4188	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:18 AM	d15b2ed5-3eec-0000-c23f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	187	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1348	4188	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:18 AM	d15b2ed5-3eec-0000-c23f-5bd1ec3ed701	d15b2ed5-3eec-0000-c43f-5bd1ec3ed701	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	186	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1348	5116	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:18 AM	d15b2ed5-3eec-0000-c43f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	185	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1348	4188	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:18 AM	d15b2ed5-3eec-0000-c23f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	184	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1348	5116	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:17 AM	d15b2ed5-3eec-0000-c23f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	183	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1712	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:22:13 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	182	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:21:45 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	181	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	524	1648	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:21:39 AM	d15b2ed5-3eec-0004-7d3e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	180	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	524	1648	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:21:39 AM	d15b2ed5-3eec-0004-7d3e-5bd1ec3ed701	d15b2ed5-3eec-0004-803e-5bd1ec3ed701	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	179	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	524	4268	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:21:39 AM	d15b2ed5-3eec-0004-803e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	178	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	524	1648	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:21:39 AM	d15b2ed5-3eec-0004-7d3e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	177	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	524	4268	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:21:39 AM	d15b2ed5-3eec-0004-7d3e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	176	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1712	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:21:34 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	175	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1728	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:10:45 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	174	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1712	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:10:41 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	173	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1708	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:10:09 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	172	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:10:05 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	171	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1712	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:10:03 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	170	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1360	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:09:58 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	169	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:09:39 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	168	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1356	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:09:36 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	167	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	4004	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:09:33 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	166	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1708	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:09:28 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	165	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1708	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:09:15 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	164	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:09:12 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	163	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1708	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:09:09 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	162	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1728	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:09:04 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	161	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1360	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:08:51 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	160	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	4004	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:08:48 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	159	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1360	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:08:45 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	158	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:08:40 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	157	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1728	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:07:59 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	156	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1728	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:07:55 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	155	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	4004	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:07:52 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	154	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1356	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:07:48 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	153	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1712	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:06:43 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	152	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	4004	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:06:39 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	151	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	4004	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:06:36 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	150	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:06:31 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	149	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1360	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:04:57 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	148	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:04:53 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	147	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1360	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:04:51 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	146	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1256	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:04:46 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	145	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:04:27 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	144	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1728	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:04:24 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	143	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1712	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:04:13 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	142	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1728	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:04:07 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	141	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1256	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:04:03 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	140	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1724	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 1:03:56 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	139	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1724	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:53:48 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	138	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1356	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:53:43 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	137	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:53:42 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	136	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1256	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:53:16 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	135	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1728	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:53:14 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	134	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	4004	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:53:12 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	133	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:53:10 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	132	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1256	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:53:08 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	131	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1356	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:53:06 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	130	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:53:04 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	129	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1256	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:53:03 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	128	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1356	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:52:56 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	127	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1256	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:52:54 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	126	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1256	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:52:53 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	125	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:52:48 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	124	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	4004	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:52:47 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	123	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:52:16 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	122	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1256	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:52:14 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	121	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:52:12 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	120	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1256	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:52:08 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	119	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1356	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:51:55 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	118	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1360	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:51:51 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	117	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	4004	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:51:49 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	116	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1712	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:51:47 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	115	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1356	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:51:22 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	114	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:51:20 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	113	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	4004	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:51:18 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	112	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:51:17 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	111	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:51:14 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	110	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:51:12 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	109	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1712	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:51:11 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	108	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	3348	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:51:05 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	107	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1708	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:50:49 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	106	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	3348	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:50:46 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	105	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1256	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:50:44 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	104	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	2528	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:50:42 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	103	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1724	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:50:33 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	102	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1356	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:50:24 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	101	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1976	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:50:18 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	100	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1716	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:50:02 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	99	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1904	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:49:58 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	98	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1904	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:49:55 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	97	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2516	4044	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:49:52 AM	d15b2ed5-3eec-0005-b030-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Activity Transfer	254	0		4	0	0	4611686018427387942	96	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2516	4044	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:49:52 AM	d15b2ed5-3eec-0005-b030-5bd1ec3ed701	d15b2ed5-3eec-0005-b630-5bd1ec3ed701	microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info		System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	95	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2516	4004	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:49:52 AM	d15b2ed5-3eec-0005-b630-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	94	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2516	2884	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:49:52 AM	d15b2ed5-3eec-0005-b030-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	93	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	2516	4004	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:49:52 AM	d15b2ed5-3eec-0005-b030-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	92	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1724	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:49:41 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
Creating WSMan shell on server with ResourceUri: %1	91	0		4	9	0	4611686018427387908	91	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	1724	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1001	5/2/2021 12:49:28 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Request handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create completed successfully	132	0		4	10	2	4611686018427387906	90	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	3040	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:18 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/certmapping	145	0		4	5	1	4611686018427387906	89	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	3320	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:18 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get failed, error code 2150858752	142	0		2	10	2	4611686018427387906	88	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	4076	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:18 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/certmapping	145	0		4	5	1	4611686018427387906	87	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	3320	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:18 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put completed successfully	132	0		4	10	2	4611686018427387906	86	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	4076	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:18 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	85	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	3320	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:18 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get completed successfully	132	0		4	10	2	4611686018427387906	84	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	3040	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:18 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	83	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	3320	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:18 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get completed successfully	132	0		4	10	2	4611686018427387906	82	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	3040	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:17 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	81	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	3320	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:17 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create completed successfully	132	0		4	10	2	4611686018427387906	80	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	3040	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:17 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Create started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	79	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	3320	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:17 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get failed, error code 2150858752	142	0		2	10	2	4611686018427387906	78	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	4076	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:17 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Listener	145	0		4	5	1	4611686018427387906	77	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	3320	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:17 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put completed successfully	132	0		4	10	2	4611686018427387906	76	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	548	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:17 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Put started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	75	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	3320	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:17 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get completed successfully	132	0		4	10	2	4611686018427387906	74	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	548	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:17 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Get started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/Config/Service/Auth	145	0		4	5	1	4611686018427387906	73	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1160	3320	hv-osbrick-7805	S-1-5-21-241273144-1942304560-1172213499-1000	5/2/2021 12:49:17 AM	d15b2ed5-3eec-0001-4a2f-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	72	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	2396	hv-osbrick-7805	S-1-5-20	5/2/2021 12:48:30 AM	d15b2ed5-3eec-0002-fe2e-5bd1ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	71	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1324	2396	hv-osbrick-7805	S-1-5-20	5/2/2021 12:48:30 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	70	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1744	1856	hv-osbrick-7805	S-1-5-20	5/2/2021 12:47:55 AM	939098b6-3eec-0005-df98-9093ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	69	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1744	1856	WIN-5T344G8GM1H	S-1-5-20	5/2/2021 12:47:55 AM	939098b6-3eec-0005-df98-9093ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	68	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1744	2156	WIN-5T344G8GM1H	S-1-5-20	5/2/2021 12:46:59 AM	939098b6-3eec-0005-df98-9093ec3ed701		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	67	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1744	2156	WIN-5T344G8GM1H	S-1-5-20	5/2/2021 12:46:59 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	66	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	1500	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:48:13 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	65	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	1500	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:48:13 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Invoke completed successfully	132	0		4	10	2	4611686018427387906	64	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4104	3660	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:42:51 AM	ad8d0f9c-9109-0003-3f12-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Invoke started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/service	145	0		4	5	1	4611686018427387906	63	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	4104	3176	WIN-5T344G8GM1H	S-1-5-21-416071247-492812682-1642729393-500	1/19/2018 9:42:51 AM	ad8d0f9c-9109-0003-3f12-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	62	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	2176	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:30 AM	ad8d0f9c-9109-0001-d70f-8dad0991d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	61	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1392	2176	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:30 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	60	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	3416	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:15 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	59	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	3416	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:41:15 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	58	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2212	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:16 AM	aff0bd57-9107-0000-a1bd-f0af0791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	57	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2212	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:16 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	56	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2004	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:00 AM	96ed06e7-9107-0002-2807-ed960791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	55	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2004	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:27:00 AM	96ed06e7-9107-0002-2807-ed960791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	54	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2284	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:41 AM	96ed06e7-9107-0002-2807-ed960791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	53	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1404	2284	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:41 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	52	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	1192	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:23 AM	17f2f0cc-9107-0000-03f1-f2170791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	51	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	1192	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:26:23 AM	17f2f0cc-9107-0000-03f1-f2170791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	50	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	2152	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:01 AM	17f2f0cc-9107-0000-03f1-f2170791d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	49	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1464	2152	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:23:01 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	48	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	3948	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:22:50 AM	289cfce6-9103-0003-08fd-9c280391d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	47	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	3948	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 9:22:50 AM	289cfce6-9103-0003-08fd-9c280391d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	46	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	2148	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:49 AM	289cfce6-9103-0003-08fd-9c280391d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	45	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1460	2148	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:49 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	44	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	1916	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:40 AM	7c5c4ffb-9102-0002-1f50-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	43	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	1916	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:54:40 AM	7c5c4ffb-9102-0002-1f50-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	42	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	2028	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	41	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	3004	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	40	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	2632	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	39	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1192	3004	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:52:27 AM	7c5c4ffb-9102-0000-4a51-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	38	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2156	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:50:03 AM	7c5c4ffb-9102-0002-1f50-5c7c0291d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	37	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1524	2156	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:50:03 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	36	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	2544	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:49:46 AM	9a81cb05-910f-0003-3ccb-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	35	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	2544	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:49:46 AM	9a81cb05-910f-0003-3ccb-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	34	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	5108	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	33	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	4228	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	32	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	2904	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	31	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	964	4228	WIN-5T344G8GM1H	S-1-5-18	1/19/2018 8:26:55 AM	9a81cb05-910f-0003-8acc-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	30	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	1772	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:23:56 AM	9a81cb05-910f-0003-3ccb-819a0f91d301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	29	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1332	1772	WIN-5T344G8GM1H	S-1-5-20	1/19/2018 8:23:56 AM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	28	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:44:39 PM	b65c0852-8ef4-0001-7408-5cb6f48ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	27	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1824	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:44:39 PM	b65c0852-8ef4-0001-7408-5cb6f48ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	26	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1464	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:25 PM	b65c0852-8ef4-0001-7408-5cb6f48ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	25	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1420	1464	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:24 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	24	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	1792	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:09 PM	53b2b737-8ef1-0002-53b7-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	23	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	1792	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 6:06:09 PM	53b2b737-8ef1-0002-53b7-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	22	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	2472	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	21	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	4780	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	20	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	2624	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	19	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1152	4780	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:44:23 PM	53b2b737-8ef1-0000-6db9-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	18	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	2064	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:42:11 PM	53b2b737-8ef1-0002-53b7-b253f18ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	17	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1400	2064	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:42:11 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	16	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	1660	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:41:56 PM	a4626349-8ea8-0002-0e64-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	15	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	1660	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:41:55 PM	a4626349-8ea8-0002-0e64-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	14	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	1564	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	13	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	3696	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	12	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	2368	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	11	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	3696	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:34:06 PM	a4626349-8ea8-0003-b36d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	10	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	2888	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/windows/shell	145	0		4	5	1	4611686018427387906	9	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	1992	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration completed successfully	132	0		4	10	2	4611686018427387906	8	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	2480	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Response handling	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
WSMan operation Enumeration started with resourceUri http://schemas.microsoft.com/wbem/wsman/1/config/listener	145	0		4	5	1	4611686018427387906	7	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	924	1992	WIN-5T344G8GM1H	S-1-5-18	1/16/2018 5:06:17 PM	a4626349-8ea8-0000-8a6d-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	WSMan API call	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service started successfully	209	0		4	11	0	4611686018427387908	6	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	2088	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:01:59 PM	a4626349-8ea8-0002-0e64-62a4a88ed301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	5	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1140	2088	WIN-5T344G8GM1H	S-1-5-20	1/16/2018 5:01:59 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service was stopped successfully	212	0		4	11	2	4611686018427387908	4	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM	60e27e42-8f3f-0001-c27e-e2603f8fd301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is stopping	211	0		4	11	0	4611686018427387908	3	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM	60e27e42-8f3f-0001-c27e-e2603f8fd301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Info	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The WinRM service is unable to start because of a failure during initialization. The error code is 2	210	0		2	11	2	4611686018427387908	2	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM	60e27e42-8f3f-0001-c27e-e2603f8fd301		microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Error	Stop	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]
The Winrm service is starting	208	0		4	11	1	4611686018427387908	1	Microsoft-Windows-WinRM	a7975c8f-ac13-49f1-87da-5a984a4ab417	Microsoft-Windows-WinRM/Operational	1644	1380	WIN-PD8DQPRRTAO	S-1-5-20	1/16/2018 5:01:16 PM			microsoft-windows-winrm/operational	System.UInt32[]	System.Diagnostics.Eventing.Reader.EventBookmark	Information	Start	Winrm service start/stop	System.Collections.ObjectModel.ReadOnlyCollection`1[System.String]	System.Collections.Generic.List`1[System.Diagnostics.Eventing.Reader.EventProperty]