Application log on \\MSEDGEWIN10:
1334,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 7:28:51 AM,916,None,"DllHost (1772,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1333,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 7:26:29 AM,916,None,"DllHost (1772,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1332,Application,VSS,INFORMATION,MSEDGEWIN10,12/21/2017 7:25:50 AM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
1331,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 7:17:23 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:23Z. Reason: RulesEngine.  "
1330,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 7:16:18 AM,916,None,"DllHost (1772,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1329,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 7:08:35 AM,916,None,"DllHost (1772,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1328,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 7:08:33 AM,916,None,"svchost (4120,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1327,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 7:06:25 AM,916,None,"taskhostw (4648,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1326,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/21/2017 7:06:08 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1325,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/21/2017 7:06:07 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
1324,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 7:00:16 AM,916,None,"svchost (2452,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1323,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:56:42 AM,326,None,"svchost (3748,D,50) DS_Token_DB: The database engine attached a database (1, C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat). (Time=0 seconds)        Saved Cache: 1 0    Additional Data: lgposAttach = 00000002:000E:0268        Internal Timing Sequence:  [1] 0.000004 +J(0) [2] 0.044999 +J(0) +M(C:0K, Fs:17, WS:4K # 4K, PF:4K # 0K, P:4K) [3] 0.653801 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:255/1) +M(C:0K, Fs:29, WS:100K # 40K, PF:36K # 0K, P:36K) [4] 0.000205 +J(0) [5] - [6] - [7] 0.098751 -0.098248 (1) CM +J(CM:1, PgRf:2, Rd:16/0, Dy:0/0, Lg:0/0) +M(C:60K, Fs:23, WS:88K # 84K, PF:116K # 92K, P:116K) [8] 0.006079 -0.005814 (1) CM +J(CM:1, PgRf:23, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:26, WS:104K # 104K, PF:196K # 192K, P:196K) [9] 0.015277 -0.015036 (2) CM +J(CM:2, PgRf:40, Rd:0/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:2, WS:8K # 8K, PF:68K # 68K, P:68K) [10] 0.000025 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 4K, PF:0K # 0K, P:0K) [11] 0.000064 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:6, WS:24K # 24K, PF:0K # 0K, P:0K) [12] 0.000001 +J(0) [13] 0.0 +J(0) [14] 0.000005 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
1322,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:56:41 AM,105,None,"svchost (3748,D,0) DS_Token_DB: The database engine started a new instance (0). (Time=3 seconds)        Additional Data:    lgposV2[] = 00000002:0009:0000 - 00000002:000C:0000 - 00000000:0000:0000 - 00000002:000C:0000 (00000000:0000:0000) cReInits = 2         Internal Timing Sequence:  [1] 0.003056 +J(0) +M(C:0K, Fs:131, WS:520K # 520K, PF:2864K # 2864K, P:2864K) [2] 0.002727 +J(0) +M(C:8K, Fs:130, WS:516K # 516K, PF:844K # 844K, P:844K) [3] 0.000044 +J(0) +M(C:0K, Fs:1, WS:4K # 4K, PF:64K # 64K, P:64K) [4] 0.000390 +J(0) +M(C:0K, Fs:24, WS:96K # 96K, PF:160K # 160K, P:160K) [5] 0.048023 +J(0) +M(C:0K, Fs:13, WS:52K # 52K, PF:20K # 20K, P:20K) [6] 0.038905 +J(0) +M(C:0K, Fs:30, WS:116K # 116K, PF:20K # 20K, P:20K) [7] 0.085644 +J(0) +M(C:0K, Fs:37, WS:148K # 148K, PF:64K # 64K, P:64K) [8] 0.916273 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:44606/130) +M(C:0K, Fs:148, WS:360K # 360K, PF:296K # 300K, P:296K) [9] - [10] 0.048841 +J(0) +M(C:0K, Fs:1, WS:-56K # 0K, PF:-60K # 0K, P:-60K) [11] 0.000029 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:49/1) +M(C:0K, Fs:3, WS:12K # 0K, PF:0K # 0K, P:0K) [12] 0.136903 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [13] 1.669293 -0.117591 (2) CM +J(CM:2, PgRf:2, Rd:0/2, Dy:0/0, Lg:8759/5) +M(C:0K, Fs:47, WS:68K # 92K, PF:160K # 164K, P:160K) [14] 0.000016 +J(0) [15] 0.000012 +J(0) [16] 0.063026 +J(0) +M(C:0K, Fs:3, WS:4K # 0K, PF:0K # 0K, P:0K).  "
1321,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:56:41 AM,302,None,"svchost (3748,U,0) DS_Token_DB: The database engine has successfully completed recovery steps.  "
1320,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:56:39 AM,301,None,"svchost (3748,R,0) DS_Token_DB: The database engine has begun replaying logfile C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log.        Previous Log Processing Stats: ?  "
1319,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:56:39 AM,300,None,"svchost (3748,R,0) DS_Token_DB: The database engine is initiating recovery steps.  "
1318,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:56:38 AM,916,None,"svchost (3748,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1317,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:56:38 AM,102,None,"svchost (3748,P,0) DS_Token_DB: The database engine (10.00.16299.0000) is starting a new instance (0).  "
1316,Application,VSS,INFORMATION,MSEDGEWIN10,12/21/2017 6:50:06 AM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
1315,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 6:49:17 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:17Z. Reason: RulesEngine.  "
1314,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,12/21/2017 6:48:49 AM,1003,None,"The Windows Search Service started.   "
1313,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:48:47 AM,326,None,"SearchIndexer (3172,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 00000020:00F0:0268        Internal Timing Sequence:  [1] 0.000002 +J(0) [2] 0.030196 +J(0) +M(C:0K, Fs:25, WS:32K # 0K, PF:32K # 0K, P:32K) [3] 0.146269 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:40, WS:124K # 0K, PF:140K # 0K, P:140K) [4] 0.000210 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [5] - [6] - [7] 0.087514 -0.000551 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:50, WS:196K # 0K, PF:644K # 0K, P:644K) [8] 0.065341 -0.064862 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:65, WS:260K # 0K, PF:288K # 140K, P:288K) [9] 0.011231 -0.010995 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:11, WS:44K # 0K, PF:96K # 96K, P:96K) [10] 0.000020 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [11] 0.000050 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [12] 0.0 +J(0) [13] 0.0 +J(0) [14] 0.000006 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
1312,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:48:46 AM,105,None,"SearchIndexer (3172,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.044194 +J(0) +M(C:0K, Fs:228, WS:892K # 892K, PF:5508K # 5508K, P:5508K) [2] 0.002657 +J(0) +M(C:10240K, Fs:102, WS:408K # 408K, PF:384K # 384K, P:384K) [3] 0.037429 +J(0) +M(C:0K, Fs:9, WS:32K # 32K, PF:68K # 68K, P:68K) [4] 0.000475 +J(0) +M(C:0K, Fs:24, WS:96K # 96K, PF:224K # 224K, P:224K) [5] 0.001712 +J(0) +M(C:0K, Fs:13, WS:52K # 52K, PF:20K # 20K, P:20K) [6] 0.003128 +J(0) +M(C:0K, Fs:29, WS:112K # 112K, PF:20K # 20K, P:20K) [7] 0.058016 +J(0) +M(C:0K, Fs:278, WS:1108K # 1108K, PF:1028K # 1028K, P:1028K) [8] - [9] - [10] - [11] - [12] - [13] 0.023344 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:10, WS:-992K # 24K, PF:-1024K # 12K, P:-1024K) [14] 0.000017 +J(0) [15] 0.000636 +J(0) +M(C:0K, Fs:32, WS:128K # 0K, PF:64K # 0K, P:64K) [16] 0.000156 +J(0) +M(C:0K, Fs:3, WS:4K # 0K, PF:0K # 0K, P:0K).  "
1311,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:48:46 AM,916,None,"SearchIndexer (3172,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1310,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:48:46 AM,102,None,"SearchIndexer (3172,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
1309,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/21/2017 6:48:46 AM,1,None,"The Windows Security Center Service has started.  "
1308,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 6:48:44 AM,900,None,"The Software Protection service is starting.  Parameters:<explicit>  "
1307,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:48:41 AM,916,None,"svchost (2468,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1306,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/21/2017 6:47:17 AM,903,None,"The Software Protection service has stopped.    "
1305,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 6:47:17 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-22T14:46:17Z. Reason: TBL.  "
1304,Application,Perflib,ERROR,MSEDGEWIN10,12/21/2017 6:47:11 AM,1008,None,"Message text not available.  Insertion strings: BITS C:\Windows\System32\bitsperf.dll 8  "
1303,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:47:04 AM,916,None,"svchost (2332,G,50) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1302,Application,MSDTC 2,INFORMATION,MSEDGEWIN10,12/21/2017 6:47:01 AM,4202,None,"Message text not available.  Insertion strings: 0 0 0 0 0 0 1 Mutual Authentication Required NT AUTHORITY\NetworkService 0 0 1  "
1301,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:56 AM,271,None,"Restored network configuration.  "
1300,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:55 AM,270,None,"Not restoring network configuration for adapter with MAC address 00:0C:29:2B:63:41. The device  ID for this adapter is unchanged.  "
1299,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:55 AM,258,None,"Restoring network configuration.  "
1298,Application,COM+,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:54 AM,781,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\COM3\Eventlog  "
1297,Application,sshd,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:54 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 3480: Server listening on 0.0.0.0 port 22.  "
1296,Application,sshd,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:54 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 3480: Server listening on :: port 22.  "
1295,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/21/2017 6:46:46 AM,902,None,"The Software Protection service has started.  10.0.16299.125  "
1294,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:46 AM,1037,None,"Time-based license remaining validity time 46986 minutes.  "
1293,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:46 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 46986)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
1292,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:44 AM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
1291,Application,OpenSSHd,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:43 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: OpenSSHd: PID 3316: `OpenSSHd' service started  "
1290,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:41 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
1289,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:41 AM,916,None,"svchost (2376,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1288,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:24 AM,916,None,"svchost (2452,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1287,Application,VMTools,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:22 AM,105,None,"The service was started.  "
1286,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:16 AM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
1285,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/21/2017 6:46:06 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
1284,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/21/2017 6:45:39 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
1283,Application,EventSystem,INFORMATION,MSEDGEWIN10,12/21/2017 6:45:46 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
1282,Application,Desktop Window Manager,INFORMATION,MSEDGEWIN10,12/21/2017 6:45:39 AM,9027,None,"The Desktop Window Manager has registered the session port.  "
1281,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:17 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
1280,Application,MSDTC,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:17 AM,4111,None,"Message text not available. "
1279,Application,VMTools,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:17 AM,108,None,"The service was stopped.  "
1278,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:17 AM,272,None,"Saved network configuration.  "
1277,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:17 AM,280,None,"Saving network configuration for adapter with MAC address 00:0C:29:2B:63:41.  "
1276,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:17 AM,260,None,"Saving network configuration.  "
1275,Application,sshd,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:16 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 4732: Server listening on 0.0.0.0 port 22.  "
1274,Application,sshd,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:16 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 4732: Server listening on :: port 22.  "
1273,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:16 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    5 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes: Process 3532 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes Process 3532 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes Process 3532 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes Process 3532 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes\Local Settings Process 3532 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes\Local Settings\Software\Microsoft   "
1272,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:16 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    16 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 784 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 784 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2284 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 2284 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2284 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 2284 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2284 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 2284 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 3532 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 2284 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 468 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 784 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 3532 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2284 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2284 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 3532 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Mobility   "
1271,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:16 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1270,Application,MSDTC 2,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:13 AM,4202,None,"Message text not available.  Insertion strings: 0 0 0 0 0 0 1 Mutual Authentication Required NT AUTHORITY\NetworkService 0 0 1  "
1269,Application,COM+,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:13 AM,781,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\COM3\Eventlog  "
1268,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:12 AM,271,None,"Restored network configuration.  "
1267,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:12 AM,270,None,"Not restoring network configuration for adapter with MAC address 00:0C:29:2B:63:41. The device  ID for this adapter is unchanged.  "
1266,Application,Puppet,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:11 AM,1,None,"Service started  "
1265,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:11 AM,258,None,"Restoring network configuration.  "
1264,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:09 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
1263,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:09 AM,916,None,"svchost (2428,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1262,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:09 AM,916,None,"svchost (2308,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1261,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/21/2017 5:58:09 AM,902,None,"The Software Protection service has started.  10.0.16299.125  "
1260,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:09 AM,1037,None,"Time-based license remaining validity time 47034 minutes.  "
1259,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:09 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 47034)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
1258,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:09 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1257,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:08 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
1256,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:09 AM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
1255,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:08 AM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
1254,Application,VMTools,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:06 AM,105,None,"The service was started.  "
1253,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:05 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
1252,Application,EventSystem,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:05 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
1251,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:58:04 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
1250,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:03 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
1249,Application,MSDTC,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:03 AM,4111,None,"Message text not available. "
1248,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/21/2017 5:57:03 AM,903,None,"The Software Protection service has stopped.    "
1247,Application,VMTools,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:02 AM,108,None,"The service was stopped.  "
1246,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:02 AM,272,None,"Saved network configuration.  "
1245,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:02 AM,280,None,"Saving network configuration for adapter with MAC address 00:0C:29:2B:63:41.  "
1244,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:02 AM,260,None,"Saving network configuration.  "
1243,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:02 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    13 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 800 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 800 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 460 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 800 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections   "
1242,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:02 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1241,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:02 AM,1003,None,"The Windows Search Service started.   "
1240,Application,OpenSSHd,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:01 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: OpenSSHd: PID 3812: `OpenSSHd' service started  "
1239,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:01 AM,326,None,"SearchIndexer (6092,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 00000020:00D0:0268        Internal Timing Sequence:  [1] 0.000002 +J(0) [2] 0.027947 +J(0) +M(C:0K, Fs:25, WS:36K # 0K, PF:32K # 0K, P:32K) [3] 0.056045 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:40, WS:124K # 0K, PF:144K # 0K, P:144K) [4] 0.000229 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [5] - [6] - [7] 0.055080 -0.001008 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:53, WS:208K # 0K, PF:664K # 0K, P:664K) [8] 0.002038 -0.001550 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:65, WS:260K # 56K, PF:288K # 244K, P:288K) [9] 0.001653 -0.001395 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:11, WS:44K # 44K, PF:96K # 96K, P:96K) [10] 0.000028 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 4K, PF:0K # 0K, P:0K) [11] 0.000072 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 16K, PF:0K # 0K, P:0K) [12] 0.000002 +J(0) [13] 0.0 +J(0) [14] 0.000008 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
1238,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:01 AM,105,None,"SearchIndexer (6092,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.002118 +J(0) +M(C:0K, Fs:213, WS:836K # 836K, PF:5460K # 5460K, P:5460K) [2] 0.001296 +J(0) +M(C:10240K, Fs:103, WS:412K # 412K, PF:388K # 388K, P:388K) [3] 0.000145 +J(0) +M(C:0K, Fs:9, WS:32K # 32K, PF:68K # 68K, P:68K) [4] 0.000459 +J(0) +M(C:0K, Fs:26, WS:100K # 100K, PF:228K # 228K, P:228K) [5] 0.002153 +J(0) +M(C:0K, Fs:12, WS:48K # 48K, PF:20K # 20K, P:20K) [6] 0.030944 +J(0) +M(C:0K, Fs:100, WS:396K # 396K, PF:56K # 56K, P:56K) [7] 0.007686 +J(0) +M(C:0K, Fs:278, WS:1108K # 1108K, PF:1028K # 1028K, P:1028K) [8] - [9] - [10] - [11] - [12] - [13] 0.001425 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:9, WS:-996K # 20K, PF:-1020K # 12K, P:-1020K) [14] 0.000013 +J(0) [15] 0.000669 +J(0) +M(C:0K, Fs:33, WS:128K # 0K, PF:64K # 0K, P:64K) [16] 0.042627 +J(0) +M(C:0K, Fs:66, WS:256K # 0K, PF:76K # 0K, P:76K).  "
1237,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:01 AM,916,None,"SearchIndexer (6092,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1236,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:01 AM,102,None,"SearchIndexer (6092,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
1235,Application,sshd,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:00 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 5976: Server listening on 0.0.0.0 port 22.  "
1234,Application,sshd,INFORMATION,MSEDGEWIN10,12/21/2017 5:57:00 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 5976: Server listening on :: port 22.  "
1233,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:56 AM,916,None,"taskhostw (4076,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1232,Application,MSDTC 2,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:54 AM,4202,None,"Message text not available.  Insertion strings: 0 0 0 0 0 0 1 Mutual Authentication Required NT AUTHORITY\NetworkService 0 0 1  "
1231,Application,Puppet,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:53 AM,1,None,"Service started  "
1230,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:51 AM,271,None,"Restored network configuration.  "
1229,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:51 AM,270,None,"Not restoring network configuration for adapter with MAC address 00:0C:29:2B:63:41. The device  ID for this adapter is unchanged.  "
1228,Application,COM+,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:51 AM,781,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\COM3\Eventlog  "
1227,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:50 AM,258,None,"Restoring network configuration.  "
1226,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:50 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1225,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:49 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
1224,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:49 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
1223,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:49 AM,916,None,"svchost (2436,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1222,Application,ESENT,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:49 AM,916,None,"svchost (2280,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1221,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/21/2017 5:56:48 AM,902,None,"The Software Protection service has started.  10.0.16299.125  "
1220,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:48 AM,1037,None,"Time-based license remaining validity time 47036 minutes.  "
1219,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:48 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 47036)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
1218,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:48 AM,1040,None,"Hardware has changed from previous boot.   AppId=55c92734-d682-4d71-983e-d6ec3f16059f, SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25.  "
1217,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:48 AM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
1216,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:47 AM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
1215,Application,VMTools,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:46 AM,105,None,"The service was started.  "
1214,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:45 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
1213,Application,EventSystem,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:44 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
1212,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/21/2017 5:56:44 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
1211,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 7:01:12 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
1210,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 7:01:12 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    25 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 512 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 732 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 732 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 4756 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 4172 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 4136 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 4172 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 4136 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 4172 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 4136 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 4172 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 4136 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 452 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 732 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 4172 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 4136 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections   "
1209,Application,VMTools,INFORMATION,MSEDGEWIN10,12/20/2017 7:01:12 AM,108,None,"The service was stopped.  "
1208,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 7:01:12 AM,272,None,"Saved network configuration.  "
1207,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 7:01:12 AM,280,None,"Saving network configuration for adapter with MAC address 00:0C:29:2B:63:41.  "
1206,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 7:01:12 AM,260,None,"Saving network configuration.  "
1205,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/20/2017 7:01:12 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1204,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/20/2017 7:00:03 AM,903,None,"The Software Protection service has stopped.    "
1203,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 7:00:03 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-21T14:59:03Z. Reason: TBL.  "
1202,Application,Puppet,ERROR,MSEDGEWIN10,12/20/2017 6:59:55 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
1201,Application,Puppet,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:43 AM,1,None,"Executing agent with arguments:   "
1200,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:36 AM,1003,None,"The Windows Search Service started.   "
1199,Application,VSS,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:36 AM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
1198,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:35 AM,326,None,"SearchIndexer (5952,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 00000020:0043:0268        Internal Timing Sequence:  [1] 0.000003 +J(0) [2] 0.002971 +J(0) +M(C:0K, Fs:24, WS:32K # 0K, PF:32K # 0K, P:32K) [3] 0.017381 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:41, WS:124K # 0K, PF:144K # 0K, P:144K) [4] 0.000093 +J(0) [5] - [6] - [7] 0.090490 -0.002645 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:52, WS:204K # 0K, PF:664K # 0K, P:664K) [8] 0.001225 -0.000968 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:65, WS:260K # 0K, PF:288K # 160K, P:288K) [9] 0.000941 -0.000655 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:11, WS:44K # 0K, PF:96K # 96K, P:96K) [10] 0.000014 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [11] 0.000047 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [12] 0.0 +J(0) [13] 0.0 +J(0) [14] 0.000005 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
1197,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:35 AM,105,None,"SearchIndexer (5952,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.000817 +J(0) +M(C:0K, Fs:175, WS:684K # 684K, PF:5472K # 5472K, P:5472K) [2] 0.000253 +J(0) +M(C:10240K, Fs:142, WS:568K # 568K, PF:380K # 380K, P:380K) [3] 0.000022 +J(0) +M(C:0K, Fs:9, WS:32K # 32K, PF:68K # 68K, P:68K) [4] 0.000082 +J(0) +M(C:0K, Fs:24, WS:96K # 96K, PF:224K # 224K, P:224K) [5] 0.001003 +J(0) +M(C:0K, Fs:16, WS:64K # 64K, PF:24K # 24K, P:24K) [6] 0.014867 +J(0) +M(C:0K, Fs:91, WS:360K # 360K, PF:32K # 32K, P:32K) [7] 0.013689 +J(0) +M(C:0K, Fs:279, WS:1112K # 1112K, PF:1040K # 1040K, P:1040K) [8] - [9] - [10] - [11] - [12] - [13] 0.005427 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:9, WS:-996K # 20K, PF:-1024K # 12K, P:-1024K) [14] 0.000014 +J(0) [15] 0.000060 +J(0) +M(C:0K, Fs:32, WS:128K # 0K, PF:64K # 0K, P:64K) [16] 0.000126 +J(0) +M(C:0K, Fs:3, WS:4K # 0K, PF:0K # 0K, P:0K).  "
1196,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:35 AM,916,None,"SearchIndexer (5952,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1195,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:35 AM,102,None,"SearchIndexer (5952,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
1194,Application,Puppet,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:34 AM,1,None,"Service started  "
1193,Application,OpenSSHd,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:34 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: OpenSSHd: PID 1388: `OpenSSHd' service started  "
1192,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:34 AM,916,None,"taskhostw (3740,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1191,Application,sshd,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:33 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 4600: Server listening on 0.0.0.0 port 22.  "
1190,Application,sshd,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:33 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 4600: Server listening on :: port 22.  "
1189,Application,MSDTC 2,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:32 AM,4202,None,"Message text not available.  Insertion strings: 0 0 0 0 0 0 1 Mutual Authentication Required NT AUTHORITY\NetworkService 0 0 1  "
1188,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:32 AM,271,None,"Restored network configuration.  "
1187,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:32 AM,270,None,"Not restoring network configuration for adapter with MAC address 00:0C:29:2B:63:41. The device  ID for this adapter is unchanged.  "
1186,Application,COM+,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:31 AM,781,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\COM3\Eventlog  "
1185,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:31 AM,258,None,"Restoring network configuration.  "
1184,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:30 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
1183,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:30 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
1182,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:30 AM,916,None,"svchost (2360,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1181,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:30 AM,916,None,"svchost (2220,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1180,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/20/2017 6:59:30 AM,902,None,"The Software Protection service has started.  10.0.16299.125  "
1179,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:30 AM,1037,None,"Time-based license remaining validity time 48413 minutes.  "
1178,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:30 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 48413)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
1177,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:30 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1176,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:30 AM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
1175,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:29 AM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
1174,Application,VMTools,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:28 AM,105,None,"The service was started.  "
1173,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:28 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
1172,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:27 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
1171,Application,EventSystem,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:27 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
1170,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:11 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
1169,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:10 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    14 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 776 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 776 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 5052 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 464 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 776 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2212 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections   "
1168,Application,VMTools,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:10 AM,108,None,"The service was stopped.  "
1167,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:10 AM,272,None,"Saved network configuration.  "
1166,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:10 AM,280,None,"Saving network configuration for adapter with MAC address 00:0C:29:2B:63:41.  "
1165,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:10 AM,260,None,"Saving network configuration.  "
1164,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/20/2017 6:59:10 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1163,Application,Puppet,ERROR,MSEDGEWIN10,12/20/2017 6:59:08 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
1162,Application,Puppet,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:55 AM,1,None,"Executing agent with arguments:   "
1161,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:53 AM,1003,None,"The Windows Search Service started.   "
1160,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:52 AM,326,None,"SearchIndexer (5916,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 0000001F:00F9:0268        Internal Timing Sequence:  [1] 0.000002 +J(0) [2] 0.010353 +J(0) +M(C:0K, Fs:24, WS:32K # 0K, PF:32K # 0K, P:32K) [3] 0.012753 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:39, WS:124K # 0K, PF:136K # 0K, P:136K) [4] 0.000125 +J(0) [5] - [6] - [7] 0.049950 -0.000518 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:54, WS:212K # 0K, PF:664K # 0K, P:664K) [8] 0.002471 -0.002266 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:65, WS:260K # 0K, PF:288K # 156K, P:288K) [9] 0.002190 -0.002066 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:11, WS:44K # 0K, PF:96K # 96K, P:96K) [10] 0.000016 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [11] 0.000080 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [12] 0.000001 +J(0) [13] 0.0 +J(0) [14] 0.000006 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
1159,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:52 AM,105,None,"SearchIndexer (5916,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.000729 +J(0) +M(C:0K, Fs:171, WS:672K # 672K, PF:4964K # 4964K, P:4964K) [2] 0.000280 +J(0) +M(C:10240K, Fs:134, WS:536K # 536K, PF:884K # 884K, P:884K) [3] 0.000025 +J(0) +M(C:0K, Fs:19, WS:72K # 72K, PF:68K # 68K, P:68K) [4] 0.000081 +J(0) +M(C:0K, Fs:27, WS:104K # 104K, PF:228K # 228K, P:228K) [5] 0.000910 +J(0) +M(C:0K, Fs:12, WS:48K # 48K, PF:20K # 20K, P:20K) [6] 0.047994 +J(0) +M(C:0K, Fs:97, WS:388K # 388K, PF:48K # 48K, P:48K) [7] 0.001898 +J(0) +M(C:0K, Fs:278, WS:1108K # 1108K, PF:1028K # 1028K, P:1028K) [8] - [9] - [10] - [11] - [12] - [13] 0.001055 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:9, WS:-996K # 20K, PF:-1020K # 12K, P:-1020K) [14] 0.000012 +J(0) [15] 0.000049 +J(0) +M(C:0K, Fs:33, WS:128K # 0K, PF:64K # 0K, P:64K) [16] 0.000118 +J(0) +M(C:0K, Fs:3, WS:4K # 0K, PF:0K # 0K, P:0K).  "
1158,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:52 AM,916,None,"SearchIndexer (5916,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1157,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:52 AM,102,None,"SearchIndexer (5916,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
1156,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:50 AM,916,None,"taskhostw (3912,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1155,Application,OpenSSHd,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:49 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: OpenSSHd: PID 3352: `OpenSSHd' service started  "
1154,Application,Puppet,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:48 AM,1,None,"Service started  "
1153,Application,sshd,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:48 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 4596: Server listening on 0.0.0.0 port 22.  "
1152,Application,sshd,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:48 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 4596: Server listening on :: port 22.  "
1151,Application,MSDTC 2,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:47 AM,4202,None,"Message text not available.  Insertion strings: 0 0 0 0 0 0 1 Mutual Authentication Required NT AUTHORITY\NetworkService 0 0 1  "
1150,Application,COM+,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:47 AM,781,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\COM3\Eventlog  "
1149,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:46 AM,271,None,"Restored network configuration.  "
1148,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:46 AM,270,None,"Not restoring network configuration for adapter with MAC address 00:0C:29:2B:63:41. The device  ID for this adapter is unchanged.  "
1147,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:46 AM,258,None,"Restoring network configuration.  "
1146,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:45 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
1145,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:45 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1144,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:45 AM,916,None,"svchost (2220,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1143,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:44 AM,916,None,"svchost (2416,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1142,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/20/2017 6:58:44 AM,902,None,"The Software Protection service has started.  10.0.16299.125  "
1141,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:44 AM,1037,None,"Time-based license remaining validity time 48414 minutes.  "
1140,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:44 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 48414)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
1139,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:44 AM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
1138,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:43 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
1137,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:43 AM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
1136,Application,VMTools,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:42 AM,105,None,"The service was started.  "
1135,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:42 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
1134,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:41 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
1133,Application,EventSystem,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:41 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
1132,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:24 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
1131,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:24 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    14 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 740 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 740 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2224 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 4736 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 2224 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2224 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 2224 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2224 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 2224 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2224 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 452 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 740 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 2224 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2224 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections   "
1130,Application,VMTools,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:24 AM,108,None,"The service was stopped.  "
1129,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:24 AM,272,None,"Saved network configuration.  "
1128,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:24 AM,280,None,"Saving network configuration for adapter with MAC address 00:0C:29:2B:63:41.  "
1127,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:24 AM,260,None,"Saving network configuration.  "
1126,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:24 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1125,Application,Puppet,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:24 AM,1,None,"Executing agent with arguments:   "
1124,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:17 AM,1003,None,"The Windows Search Service started.   "
1123,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:16 AM,326,None,"SearchIndexer (6120,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 0000001F:00C8:0268        Internal Timing Sequence:  [1] 0.000003 +J(0) [2] 0.002136 +J(0) +M(C:0K, Fs:25, WS:32K # 0K, PF:32K # 0K, P:32K) [3] 0.009249 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:41, WS:124K # 0K, PF:144K # 0K, P:144K) [4] 0.000100 +J(0) [5] - [6] - [7] 0.028765 -0.000431 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:50, WS:196K # 0K, PF:644K # 0K, P:644K) [8] 0.001283 -0.001048 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:65, WS:260K # 0K, PF:288K # 140K, P:288K) [9] 0.000614 -0.000505 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:11, WS:44K # 0K, PF:96K # 96K, P:96K) [10] 0.000013 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [11] 0.000044 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [12] 0.0 +J(0) [13] 0.0 +J(0) [14] 0.000005 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
1122,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:16 AM,105,None,"SearchIndexer (6120,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.006456 +J(0) +M(C:0K, Fs:243, WS:956K # 956K, PF:5476K # 5476K, P:5476K) [2] 0.000257 +J(0) +M(C:10240K, Fs:118, WS:472K # 472K, PF:388K # 388K, P:388K) [3] 0.000020 +J(0) +M(C:0K, Fs:6, WS:20K # 20K, PF:68K # 68K, P:68K) [4] 0.000089 +J(0) +M(C:0K, Fs:25, WS:100K # 100K, PF:224K # 224K, P:224K) [5] 0.001046 +J(0) +M(C:0K, Fs:14, WS:56K # 56K, PF:24K # 24K, P:24K) [6] 0.020258 +J(0) +M(C:0K, Fs:54, WS:212K # 212K, PF:24K # 24K, P:24K) [7] 0.037973 +J(0) +M(C:0K, Fs:280, WS:1116K # 1116K, PF:1040K # 1040K, P:1040K) [8] - [9] - [10] - [11] - [12] - [13] 0.001084 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:9, WS:-996K # 20K, PF:-1024K # 12K, P:-1024K) [14] 0.000013 +J(0) [15] 0.000066 +J(0) +M(C:0K, Fs:32, WS:128K # 0K, PF:64K # 0K, P:64K) [16] 0.000146 +J(0) +M(C:0K, Fs:3, WS:4K # 0K, PF:0K # 0K, P:0K).  "
1121,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:16 AM,916,None,"SearchIndexer (6120,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1120,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:16 AM,102,None,"SearchIndexer (6120,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
1119,Application,OpenSSHd,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:15 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: OpenSSHd: PID 3420: `OpenSSHd' service started  "
1118,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:14 AM,916,None,"taskhostw (3876,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1117,Application,sshd,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:14 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 4856: Server listening on 0.0.0.0 port 22.  "
1116,Application,sshd,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:14 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 4856: Server listening on :: port 22.  "
1115,Application,Puppet,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:13 AM,1,None,"Service started  "
1114,Application,MSDTC 2,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:13 AM,4202,None,"Message text not available.  Insertion strings: 0 0 0 0 0 0 1 Mutual Authentication Required NT AUTHORITY\NetworkService 0 0 1  "
1113,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:12 AM,271,None,"Restored network configuration.  "
1112,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:12 AM,270,None,"Not restoring network configuration for adapter with MAC address 00:0C:29:2B:63:41. The device  ID for this adapter is unchanged.  "
1111,Application,COM+,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:12 AM,781,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\COM3\Eventlog  "
1110,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:11 AM,258,None,"Restoring network configuration.  "
1109,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:10 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
1108,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:10 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
1107,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:10 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1106,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:10 AM,916,None,"svchost (2248,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1105,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/20/2017 6:58:10 AM,902,None,"The Software Protection service has started.  10.0.16299.125  "
1104,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:10 AM,1037,None,"Time-based license remaining validity time 48414 minutes.  "
1103,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:10 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 48414)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
1102,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:10 AM,916,None,"svchost (2364,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1101,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:10 AM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
1100,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:09 AM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
1099,Application,VMTools,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:08 AM,105,None,"The service was started.  "
1098,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:08 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
1097,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:07 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
1096,Application,EventSystem,INFORMATION,MSEDGEWIN10,12/20/2017 6:58:07 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
1095,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:45 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
1094,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:45 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    14 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 776 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 776 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2264 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 5128 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 2264 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2264 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 2264 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2264 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 2264 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2264 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 472 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 776 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 2264 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2264 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections   "
1093,Application,VMTools,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:45 AM,108,None,"The service was stopped.  "
1092,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:45 AM,272,None,"Saved network configuration.  "
1091,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:45 AM,280,None,"Saving network configuration for adapter with MAC address 00:0C:29:2B:63:41.  "
1090,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:45 AM,260,None,"Saving network configuration.  "
1089,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:45 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1088,Application,Puppet,ERROR,MSEDGEWIN10,12/20/2017 6:57:39 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
1087,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:35 AM,1003,None,"The Windows Search Service started.   "
1086,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:34 AM,326,None,"SearchIndexer (6592,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 0000001F:00A8:0268        Internal Timing Sequence:  [1] 0.000005 +J(0) [2] 0.003183 +J(0) +M(C:0K, Fs:40, WS:96K # 0K, PF:32K # 0K, P:32K) [3] 0.012266 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:50, WS:160K # 0K, PF:152K # 0K, P:152K) [4] 0.000118 +J(0) [5] - [6] - [7] 0.024393 -0.000617 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:52, WS:204K # 0K, PF:664K # 0K, P:664K) [8] 0.001572 -0.001290 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:65, WS:260K # 28K, PF:288K # 188K, P:288K) [9] 0.000592 -0.000481 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:11, WS:44K # 44K, PF:96K # 96K, P:96K) [10] 0.000019 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 4K, PF:0K # 0K, P:0K) [11] 0.000062 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 16K, PF:0K # 0K, P:0K) [12] 0.000001 +J(0) [13] 0.0 +J(0) [14] 0.000034 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
1085,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:34 AM,105,None,"SearchIndexer (6592,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.000876 +J(0) +M(C:0K, Fs:176, WS:684K # 684K, PF:5460K # 5460K, P:5460K) [2] 0.000315 +J(0) +M(C:10240K, Fs:142, WS:568K # 568K, PF:384K # 384K, P:384K) [3] 0.000077 +J(0) +M(C:0K, Fs:8, WS:32K # 32K, PF:64K # 64K, P:64K) [4] 0.000093 +J(0) +M(C:0K, Fs:25, WS:96K # 96K, PF:228K # 228K, P:228K) [5] 0.000900 +J(0) +M(C:0K, Fs:12, WS:48K # 48K, PF:20K # 20K, P:20K) [6] 0.001238 +J(0) +M(C:0K, Fs:29, WS:112K # 112K, PF:20K # 20K, P:20K) [7] 0.001789 +J(0) +M(C:0K, Fs:278, WS:1108K # 1108K, PF:1028K # 1028K, P:1028K) [8] - [9] - [10] - [11] - [12] - [13] 0.001189 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:9, WS:-996K # 20K, PF:-1024K # 12K, P:-1024K) [14] 0.000014 +J(0) [15] 0.000062 +J(0) +M(C:0K, Fs:36, WS:148K # 0K, PF:68K # 0K, P:68K) [16] 0.000161 +J(0) +M(C:0K, Fs:9, WS:24K # 0K, PF:0K # 0K, P:0K).  "
1084,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:34 AM,916,None,"SearchIndexer (6592,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1083,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:34 AM,102,None,"SearchIndexer (6592,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
1082,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:32 AM,916,None,"taskhostw (4752,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1081,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:22 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1080,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:22 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
1079,Application,Puppet,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:19 AM,1,None,"Executing agent with arguments:   "
1078,Application,OpenSSHd,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:14 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: OpenSSHd: PID 3668: `OpenSSHd' service started  "
1077,Application,sshd,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:14 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 3988: Server listening on 0.0.0.0 port 22.  "
1076,Application,sshd,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:14 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 3988: Server listening on :: port 22.  "
1075,Application,Puppet,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:12 AM,1,None,"Service started  "
1074,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:12 AM,271,None,"Restored network configuration.  "
1073,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:12 AM,270,None,"Not restoring network configuration for adapter with MAC address 00:0C:29:2B:63:41. The device  ID for this adapter is unchanged.  "
1072,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:11 AM,258,None,"Restoring network configuration.  "
1071,Application,MSDTC 2,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:11 AM,4202,None,"Message text not available.  Insertion strings: 0 0 0 0 0 0 1 Mutual Authentication Required NT AUTHORITY\NetworkService 0 0 1  "
1070,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:10 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
1069,Application,COM+,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:11 AM,781,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\COM3\Eventlog  "
1068,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/20/2017 6:57:10 AM,902,None,"The Software Protection service has started.  10.0.16299.125  "
1067,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:10 AM,1037,None,"Time-based license remaining validity time 48415 minutes.  "
1066,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:10 AM,916,None,"svchost (2400,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1065,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:10 AM,916,None,"svchost (2272,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1064,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:10 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 0 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 48415)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
1063,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:10 AM,1033,None,"These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=55c92734-d682-4d71-983e-d6ec3f16059f  Sku Id=3f4c0546-36c6-46a8-a37f-be13cdd0cf25  "
1062,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:10 AM,1034,None,"Duplicate definition of policy found. Policy name=Security-SPP-Reserved-LicenseProperties  Priority=100  "
1061,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:09 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
1060,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:09 AM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
1059,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:08 AM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
1058,Application,VMTools,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:07 AM,105,None,"The service was started.  "
1057,Application,Desktop Window Manager,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:05 AM,9027,None,"The Desktop Window Manager has registered the session port.  "
1056,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:03 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
1055,Application,EventSystem,INFORMATION,MSEDGEWIN10,12/20/2017 6:57:03 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
1054,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 5:49:56 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
1053,Application,VMTools,INFORMATION,MSEDGEWIN10,12/20/2017 5:49:55 AM,108,None,"The service was stopped.  "
1052,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 5:49:55 AM,272,None,"Saved network configuration.  "
1051,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 5:49:55 AM,280,None,"Saving network configuration for adapter with MAC address 00:0C:29:2B:63:41.  "
1050,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/20/2017 5:49:55 AM,260,None,"Saving network configuration.  "
1049,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/20/2017 5:49:16 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    15 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 516 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 768 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 768 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2300 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 7652 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 2300 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2300 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 2300 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2300 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 2300 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2300 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 460 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 768 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 2300 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 7504 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections   "
1048,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/20/2017 5:49:16 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
1047,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 5:31:00 AM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1046,Application,Puppet,ERROR,MSEDGEWIN10,12/20/2017 5:28:21 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
1045,Application,Puppet,INFORMATION,MSEDGEWIN10,12/20/2017 5:28:11 AM,1,None,"Executing agent with arguments:   "
1044,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 5:26:39 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:39Z. Reason: RulesEngine.  "
1043,Application,SpeechRuntime,UNKNOWN TYPE,MSEDGEWIN10,12/20/2017 5:11:56 AM,1,None,"Audio Orchestrator Power Event: Battery Saver Is Not Enabled, Voice Activation Ready  "
1042,Application,Puppet,ERROR,MSEDGEWIN10,12/20/2017 4:58:09 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
1041,Application,Puppet,INFORMATION,MSEDGEWIN10,12/20/2017 4:57:59 AM,1,None,"Executing agent with arguments:   "
1040,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 4:56:33 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:33Z. Reason: RulesEngine.  "
1039,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 4:48:04 AM,916,None,"svchost (2888,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1038,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 4:30:00 AM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1037,Application,Puppet,ERROR,MSEDGEWIN10,12/20/2017 4:27:57 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
1036,Application,Puppet,INFORMATION,MSEDGEWIN10,12/20/2017 4:27:46 AM,1,None,"Executing agent with arguments:   "
1035,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 4:26:28 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:28Z. Reason: RulesEngine.  "
1034,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 4:24:11 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:52:11Z. Reason: RulesEngine.  "
1033,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 4:10:44 AM,916,None,"svchost (2888,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1032,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,12/20/2017 4:01:17 AM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Browser History Spy. Product Version: 5.0. Product Language: 1033. Manufacturer: SecurityXploded. Installation success or error status: 0.  "
1031,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,12/20/2017 4:01:17 AM,11708,IEUser\MSEDGEWIN10,"Product: Browser History Spy -- Installation failed.  "
1030,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 3:59:09 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:52:09Z. Reason: RulesEngine.  "
1029,Application,Puppet,ERROR,MSEDGEWIN10,12/20/2017 3:57:56 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
1028,Application,Puppet,INFORMATION,MSEDGEWIN10,12/20/2017 3:57:33 AM,1,None,"Executing agent with arguments:   "
1027,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 3:57:05 AM,916,None,"svchost (2888,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1026,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 3:56:22 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:22Z. Reason: RulesEngine.  "
1025,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 3:48:25 AM,916,None,"MicrosoftEdge (7764,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1024,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 3:29:00 AM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1023,Application,Puppet,ERROR,MSEDGEWIN10,12/20/2017 3:27:43 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
1022,Application,Puppet,INFORMATION,MSEDGEWIN10,12/20/2017 3:27:19 AM,1,None,"Executing agent with arguments:   "
1021,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/20/2017 3:26:17 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:17Z. Reason: RulesEngine.  "
1020,Application,ESENT,INFORMATION,MSEDGEWIN10,12/20/2017 3:24:18 AM,916,None,"svchost (2888,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1019,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 10:34:17 PM,916,None,"MicrosoftEdge (2660,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1018,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 10:33:28 PM,916,None,"MicrosoftEdge (3016,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1017,Application,Puppet,ERROR,MSEDGEWIN10,12/19/2017 10:11:27 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
1016,Application,Puppet,INFORMATION,MSEDGEWIN10,12/19/2017 10:11:03 PM,1,None,"Executing agent with arguments:   "
1015,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 10:10:08 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:52:08Z. Reason: RulesEngine.  "
1014,Application,SpeechRuntime,UNKNOWN TYPE,MSEDGEWIN10,12/19/2017 9:56:35 PM,1,None,"Audio Orchestrator Power Event: Battery Saver Is Not Enabled, Voice Activation Ready  "
1013,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 9:52:01 PM,916,None,"svchost (2888,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1012,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 9:42:00 PM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1011,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 9:41:17 PM,916,None,"svchost (2888,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1010,Application,Puppet,ERROR,MSEDGEWIN10,12/19/2017 9:41:16 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
1009,Application,Puppet,INFORMATION,MSEDGEWIN10,12/19/2017 9:40:52 PM,1,None,"Executing agent with arguments:   "
1008,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 9:40:03 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:52:03Z. Reason: RulesEngine.  "
1007,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 9:25:35 PM,916,None,"MicrosoftEdge (4712,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1006,Application,Puppet,ERROR,MSEDGEWIN10,12/19/2017 9:11:03 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
1005,Application,Puppet,INFORMATION,MSEDGEWIN10,12/19/2017 9:10:39 PM,1,None,"Executing agent with arguments:   "
1004,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 9:09:57 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:57Z. Reason: RulesEngine.  "
1003,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 8:54:02 PM,916,None,"svchost (2888,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1002,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 8:46:00 PM,916,None,"svchost (5964,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1001,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 8:41:00 PM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
1000,Application,Puppet,ERROR,MSEDGEWIN10,12/19/2017 8:40:48 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
999,Application,Puppet,INFORMATION,MSEDGEWIN10,12/19/2017 8:40:25 PM,1,None,"Executing agent with arguments:   "
998,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 8:39:52 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:52Z. Reason: RulesEngine.  "
997,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 8:39:22 PM,1033,None,"These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=55c92734-d682-4d71-983e-d6ec3f16059f  Sku Id=3f4c0546-36c6-46a8-a37f-be13cdd0cf25  "
996,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 8:39:22 PM,1034,None,"Duplicate definition of policy found. Policy name=Security-SPP-Reserved-LicenseProperties  Priority=100  "
995,Application,VSS,INFORMATION,MSEDGEWIN10,12/19/2017 8:38:07 PM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
994,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 8:33:30 PM,916,None,"svchost (2280,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
993,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 8:30:27 PM,1001,None,"Fault bucket 1633472171182928858, type 5  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4DF5.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E23.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E44.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_12c9545d    Analysis symbol: ?  Rechecking for solution: 0  Report Id: f75ff2ca-f80b-4f99-9068-1b359823256f  Report Status: 268435456  Hashed bucket: ef5365cbdcad9dbaa6ab424901d833da  "
992,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 8:30:25 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4DF5.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E23.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E44.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_0ad14e52    Analysis symbol: ?  Rechecking for solution: 0  Report Id: f75ff2ca-f80b-4f99-9068-1b359823256f  Report Status: 4  Hashed bucket: ?  "
991,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 8:30:25 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:?    These files may be available here:  ?    Analysis symbol: ?  Rechecking for solution: 0  Report Id: f75ff2ca-f80b-4f99-9068-1b359823256f  Report Status: 1074003968  Hashed bucket: ?  "
990,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 8:28:18 PM,1001,None,"Fault bucket 133557830856, type 5  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_10af603e    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 268435556  Hashed bucket: 06890db7c59d2ccc7bebd0df625b8e00  "
989,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 8:28:16 PM,1001,None,"Fault bucket 128063343910, type 5  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_10af5561    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 268435556  Hashed bucket: affc15100eb96640c7093be4024fa86d  "
988,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 8:28:14 PM,1001,None,"Fault bucket 128063360735, type 5  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_10af4e5c    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 268435556  Hashed bucket: c4e012742e319642eb4bef6dfe6d4476  "
987,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 8:28:12 PM,1001,None,"Fault bucket 1633472171182928858, type 5  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_10af4812    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 268435556  Hashed bucket: ef5365cbdcad9dbaa6ab424901d833da  "
986,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 8:28:09 PM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
985,Application,Puppet,ERROR,MSEDGEWIN10,12/19/2017 8:10:35 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
984,Application,Puppet,INFORMATION,MSEDGEWIN10,12/19/2017 8:10:16 PM,1,None,"Executing agent with arguments:   "
983,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 8:09:46 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:46Z. Reason: RulesEngine.  "
982,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 8:05:34 PM,916,None,"DllHost (4664,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
981,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 8:05:10 PM,1001,None,"Fault bucket ?, type 0  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 100  Hashed bucket: ?  "
980,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 8:05:10 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
979,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 8:05:10 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
978,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 8:05:10 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
977,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 7:47:44 PM,916,None,"DllHost (4664,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
976,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 7:40:24 PM,1001,None,"Fault bucket ?, type 0  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 100  Hashed bucket: ?  "
975,Application,Puppet,ERROR,MSEDGEWIN10,12/19/2017 7:40:24 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
974,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 7:40:23 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
973,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 7:40:23 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
972,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 7:40:23 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
971,Application,Puppet,INFORMATION,MSEDGEWIN10,12/19/2017 7:40:05 PM,1,None,"Executing agent with arguments:   "
970,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 7:40:00 PM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
969,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 7:39:40 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:40Z. Reason: RulesEngine.  "
968,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 7:36:35 PM,1001,None,"Fault bucket ?, type 0  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 100  Hashed bucket: ?  "
967,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 7:36:35 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
966,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 7:36:35 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
965,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 7:36:35 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
964,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 7:17:48 PM,1001,None,"Fault bucket ?, type 0  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 100  Hashed bucket: ?  "
963,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 7:17:48 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
962,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 7:17:48 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
961,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 7:17:35 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
960,Application,Puppet,ERROR,MSEDGEWIN10,12/19/2017 7:10:12 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
959,Application,Puppet,INFORMATION,MSEDGEWIN10,12/19/2017 7:09:52 PM,1,None,"Executing agent with arguments:   "
958,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 7:09:35 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:35Z. Reason: RulesEngine.  "
957,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 7:04:37 PM,916,None,"MicrosoftEdge (5312,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
956,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 6:56:18 PM,916,None,"DllHost (4664,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
955,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 6:49:24 PM,1001,None,"Fault bucket ?, type 0  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 100  Hashed bucket: ?  "
954,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 6:49:24 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
953,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 6:49:24 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
952,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 6:49:24 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
951,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 6:44:06 PM,916,None,"DllHost (4664,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
950,Application,Puppet,ERROR,MSEDGEWIN10,12/19/2017 6:39:59 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
949,Application,Puppet,INFORMATION,MSEDGEWIN10,12/19/2017 6:39:41 PM,1,None,"Executing agent with arguments:   "
948,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 6:39:30 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:30Z. Reason: RulesEngine.  "
947,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 6:39:00 PM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
946,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 6:24:47 PM,1001,None,"Fault bucket ?, type 0  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 100  Hashed bucket: ?  "
945,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 6:24:47 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
944,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 6:24:47 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
943,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 6:24:47 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
942,Application,SpeechRuntime,UNKNOWN TYPE,MSEDGEWIN10,12/19/2017 6:24:45 PM,1,None,"Audio Orchestrator Power Event: Battery Saver Is Not Enabled, Voice Activation Ready  "
941,Application,Puppet,ERROR,MSEDGEWIN10,12/19/2017 6:09:49 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
940,Application,Puppet,INFORMATION,MSEDGEWIN10,12/19/2017 6:09:30 PM,1,None,"Executing agent with arguments:   "
939,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 6:09:24 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:24Z. Reason: RulesEngine.  "
938,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 6:08:50 PM,1001,None,"Fault bucket ?, type 0  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 100  Hashed bucket: ?  "
937,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 6:08:50 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
936,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 6:08:50 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
935,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 6:08:50 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
934,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 5:50:34 PM,1001,None,"Fault bucket ?, type 0  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 100  Hashed bucket: ?  "
933,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 5:50:34 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
932,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 5:50:34 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
931,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 5:50:34 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
930,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 5:47:00 PM,916,None,"DllHost (4664,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
929,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 5:38:00 PM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
928,Application,Puppet,ERROR,MSEDGEWIN10,12/19/2017 5:37:52 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
927,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 5:37:41 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:41Z. Reason: RulesEngine.  "
926,Application,Puppet,INFORMATION,MSEDGEWIN10,12/19/2017 5:37:40 PM,1,None,"Executing agent with arguments:   "
925,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 5:30:18 PM,1001,None,"Fault bucket ?, type 0  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 100  Hashed bucket: ?  "
924,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 5:30:18 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
923,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 5:30:18 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
922,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 5:30:18 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
921,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 5:28:11 PM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
920,Application,SpeechRuntime,UNKNOWN TYPE,MSEDGEWIN10,12/19/2017 5:18:10 PM,1,None,"Audio Orchestrator Power Event: Battery Saver Is Not Enabled, Voice Activation Ready  "
919,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 5:08:51 PM,916,None,"DllHost (4664,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
918,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 5:08:46 PM,1001,None,"Fault bucket ?, type 0  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 100  Hashed bucket: ?  "
917,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 5:08:46 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
916,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 5:08:46 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
915,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 5:08:31 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
914,Application,Puppet,ERROR,MSEDGEWIN10,12/19/2017 4:18:30 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
913,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 4:18:18 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:18Z. Reason: RulesEngine.  "
912,Application,Puppet,INFORMATION,MSEDGEWIN10,12/19/2017 4:18:10 PM,1,None,"Executing agent with arguments:   "
911,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 4:18:01 PM,1001,None,"Fault bucket ?, type 0  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 100  Hashed bucket: ?  "
910,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 4:18:01 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
909,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 4:18:01 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
908,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 4:18:01 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
907,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 4:17:14 PM,1001,None,"Fault bucket ?, type 0  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 100  Hashed bucket: ?  "
906,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 4:17:14 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
905,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 4:17:14 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
904,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 4:17:14 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
903,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 4:17:14 PM,1001,None,"Fault bucket ?, type 0  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:SecHealthUI  P3: 10.0.16299.15  P4: 59cda931  P5: SecHealthUI.exe  P6: 10.0.16299.15  P7: 59cda931  P8: c0000005  P9: 0000000000059975  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER17DA.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B06.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B26.tmp.txt  \\?\C:\Users\IEUser\AppData\Local\Temp\WER1BA5.tmp.appcompat.txt  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2\memory.hdmp    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Microsoft.Window_57ac9e654b391b9651cc28f2fdddd91ac59e1ab_a647287e_cab_1f271bc2    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Report Status: 100  Hashed bucket: ?  "
902,Application,Application Error,ERROR,MSEDGEWIN10,12/19/2017 4:17:12 PM,1000,None,"Faulting application name: SecHealthUI.exe, version: 10.0.16299.15, time stamp: 0x59cda931  Faulting module name: SecHealthUI.exe, version: 10.0.16299.15, time stamp: 0x59cda931  Exception code: 0xc0000005  Fault offset: 0x0000000000059975  Faulting process id: 0x152c  Faulting application start time: 0x01d37927e1b5292b  Faulting application path: C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe  Faulting module path: C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe  Report Id: 383543bd-1a5b-4723-90db-34dd19d7be2c  Faulting package full name: Microsoft.Windows.SecHealthUI_10.0.16299.15_neutral__cw5n1h2txyewy  Faulting package-relative application ID: SecHealthUI  "
901,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 4:16:37 PM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
900,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 4:16:24 PM,916,None,"DllHost (4664,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
899,Application,VSS,INFORMATION,MSEDGEWIN10,12/19/2017 4:16:03 PM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
898,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 4:13:00 PM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
897,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 4:09:41 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
896,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 4:09:41 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
895,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 4:09:41 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
894,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 4:02:58 PM,1001,None,"Fault bucket ?, type 0  Event Name: RADAR_PRE_LEAK_64  Response: Not available  Cab Id: 0    Problem signature:  P1: TiWorker.exe  P2: 10.0.16299.15  P3: 10.0.16299.2.0.0  P4: ?  P5: ?  P6: ?  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Users\IEUser\AppData\Local\Temp\RDRE86C.tmp\empty.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE86D.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE89B.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8AC.tmp.txt    These files may be available here:  ?    Analysis symbol: ?  Rechecking for solution: 0  Report Id: dae63d05-6257-42bd-905c-c0b5ac029aea  Report Status: 536871008  Hashed bucket: ?  "
893,Application,VSS,INFORMATION,MSEDGEWIN10,12/19/2017 4:01:11 PM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
892,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:59:39 PM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
891,Application,Microsoft-Windows-Defrag,UNKNOWN TYPE,MSEDGEWIN10,12/19/2017 3:58:25 PM,258,None,"The storage optimizer successfully completed defragmentation on Windows 10 (C:)  "
890,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:58:14 PM,326,None,"svchost (3636,D,50) DS_Token_DB: The database engine attached a database (1, C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat). (Time=0 seconds)        Saved Cache: 1 0    Additional Data: lgposAttach = 00000002:000A:0268        Internal Timing Sequence:  [1] 0.000003 +J(0) [2] 0.000938 +J(0) +M(C:0K, Fs:17, WS:4K # 4K, PF:4K # 0K, P:4K) [3] 0.017722 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:10, WS:36K # 0K, PF:36K # 0K, P:36K) [4] 0.000176 +J(0) [5] - [6] - [7] 0.007023 -0.006737 (1) CM +J(CM:1, PgRf:2, Rd:16/0, Dy:0/0, Lg:0/0) +M(C:60K, Fs:23, WS:88K # 60K, PF:116K # 92K, P:116K) [8] 0.001502 -0.001297 (1) CM +J(CM:1, PgRf:23, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:26, WS:104K # 104K, PF:196K # 192K, P:196K) [9] 0.004089 -0.003910 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 4K, PF:64K # 64K, P:64K) [10] 0.000026 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 4K, PF:0K # 0K, P:0K) [11] 0.000068 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:6, WS:24K # 24K, PF:0K # 0K, P:0K) [12] 0.000017 +J(0) [13] 0.0 +J(0) [14] 0.000008 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
889,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:58:14 PM,105,None,"svchost (3636,D,0) DS_Token_DB: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    lgposV2[] = 00000002:0005:0000 - 00000002:0008:0000 - 00000000:0000:0000 - 00000002:0008:0000 (00000000:0000:0000) cReInits = 1         Internal Timing Sequence:  [1] 0.002332 +J(0) +M(C:0K, Fs:173, WS:688K # 688K, PF:3408K # 3408K, P:3408K) [2] 0.000282 +J(0) +M(C:8K, Fs:86, WS:340K # 340K, PF:296K # 296K, P:296K) [3] 0.000014 +J(0) +M(C:0K, Fs:1, WS:4K # 4K, PF:64K # 64K, P:64K) [4] 0.000105 +J(0) +M(C:0K, Fs:26, WS:100K # 100K, PF:164K # 164K, P:164K) [5] 0.001241 +J(0) +M(C:0K, Fs:14, WS:56K # 56K, PF:24K # 24K, P:24K) [6] 0.001513 +J(0) +M(C:0K, Fs:31, WS:120K # 120K, PF:24K # 24K, P:24K) [7] 0.002883 +J(0) +M(C:0K, Fs:37, WS:148K # 148K, PF:64K # 64K, P:64K) [8] 0.016950 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:28382/120) +M(C:0K, Fs:116, WS:316K # 316K, PF:216K # 220K, P:216K) [9] - [10] 0.000756 +J(0) +M(C:0K, Fs:1, WS:-56K # 0K, PF:-60K # 0K, P:-60K) [11] 0.000024 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:49/1) +M(C:0K, Fs:3, WS:12K # 0K, PF:0K # 0K, P:0K) [12] 0.001682 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [13] 0.045180 -0.000981 (2) CM +J(CM:2, PgRf:2, Rd:0/2, Dy:0/0, Lg:8759/5) +M(C:0K, Fs:54, WS:96K # 120K, PF:216K # 220K, P:216K) [14] 0.000016 +J(0) [15] 0.000011 +J(0) [16] 0.000894 +J(0) +M(C:0K, Fs:3, WS:4K # 0K, PF:0K # 0K, P:0K).  "
888,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:58:14 PM,302,None,"svchost (3636,U,0) DS_Token_DB: The database engine has successfully completed recovery steps.  "
887,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:58:14 PM,301,None,"svchost (3636,R,0) DS_Token_DB: The database engine has begun replaying logfile C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log.        Previous Log Processing Stats: ?  "
886,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:58:14 PM,300,None,"svchost (3636,R,0) DS_Token_DB: The database engine is initiating recovery steps.  "
885,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:58:14 PM,916,None,"svchost (3636,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
884,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:58:14 PM,102,None,"svchost (3636,P,0) DS_Token_DB: The database engine (10.00.16299.0000) is starting a new instance (0).  "
883,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 3:53:21 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 100  Hashed bucket: ?  "
882,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 3:53:21 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
881,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 3:53:21 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
880,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 3:53:15 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:15Z. Reason: RulesEngine.  "
879,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 3:53:09 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER211C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER212F.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER2150.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_368839f40eaa95126ec53dcabfb41ce4dad6582_00000000_cab_1f5d214b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 4  Hashed bucket: ?  "
878,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 3:53:09 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:?    These files may be available here:  ?    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ba21efdf-9608-4bba-9e72-a81db1a3edae  Report Status: 1074003968  Hashed bucket: ?  "
877,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 3:53:04 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 100  Hashed bucket: ?  "
876,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 3:53:04 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
875,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 3:53:04 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD17.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD28.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERD39.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_c637f8b2cda36fdca625d086163f3b1f95675546_00000000_cab_1b250d36    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 4  Hashed bucket: ?  "
874,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 3:53:04 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024402c  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 0  P6: 0  P7: 8024500b  P8: UpdateOrchestrator  P9: {7971F918-A847-4430-9279-4A52D1EFE18D}  P10: 0    Attached files:?    These files may be available here:  ?    Analysis symbol: ?  Rechecking for solution: 0  Report Id: abd5eb36-2f4a-4ac2-b56f-dd064b9ebf5d  Report Status: 1074003968  Hashed bucket: ?  "
873,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 3:52:01 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 100  Hashed bucket: ?  "
872,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 3:51:49 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9E4.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA03.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA14.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.64_6c3dc0ee2a5822f716f7c22e6217724c9ae21d1e_00000000_cab_14b7ea22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 4  Hashed bucket: ?  "
871,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/19/2017 3:51:49 PM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.64  P2: 8024200d  P3: B6662D11-D531-4BE2-ABF6-C607F092284D  P4: Install  P5: 1  P6: 0  P7: 0  P8: UpdateOrchestrator  P9: {8B24B027-1DEE-BABB-9A95-3517DFB9C552}  P10: 0    Attached files:?    These files may be available here:  ?    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d59b44f9-b9c2-4280-9c16-2a70c085bd35  Report Status: 1074003968  Hashed bucket: ?  "
870,Application,VSS,INFORMATION,MSEDGEWIN10,12/19/2017 3:50:47 PM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
869,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 3:50:05 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:52:05Z. Reason: RulesEngine.  "
868,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/19/2017 3:49:46 PM,1,None,"The Windows Security Center Service has started.  "
867,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:49:46 PM,916,None,"svchost (3332,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
866,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/19/2017 3:48:29 PM,903,None,"The Software Protection service has stopped.    "
865,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 3:48:29 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-20T23:47:29Z. Reason: TBL.  "
864,Application,Puppet,ERROR,MSEDGEWIN10,12/19/2017 3:48:15 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
863,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:48:08 PM,916,None,"svchost (2280,G,50) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
862,Application,Perflib,ERROR,MSEDGEWIN10,12/19/2017 3:48:04 PM,1008,None,"Message text not available.  Insertion strings: BITS C:\Windows\System32\bitsperf.dll 8  "
861,Application,SpeechRuntime,UNKNOWN TYPE,MSEDGEWIN10,12/19/2017 3:48:00 PM,1,None,"Audio Orchestrator Power Event: Battery Saver Is Not Enabled, Voice Activation Ready  "
860,Application,Puppet,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:59 PM,1,None,"Executing agent with arguments:   "
859,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:57 PM,916,None,"DllHost (4664,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
858,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:55 PM,916,None,"svchost (2888,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
857,Application,Puppet,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:50 PM,1,None,"Service started  "
856,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:49 PM,916,None,"taskhostw (4112,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
855,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:48 PM,1003,None,"The Windows Search Service started.   "
854,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:47 PM,326,None,"SearchIndexer (4688,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 0000000E:00D8:0268        Internal Timing Sequence:  [1] 0.000006 +J(0) [2] 0.000837 +J(0) +M(C:0K, Fs:24, WS:32K # 0K, PF:32K # 0K, P:32K) [3] 0.033551 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:39, WS:120K # 0K, PF:140K # 0K, P:140K) [4] 0.000174 +J(0) [5] - [6] - [7] 0.054969 -0.000746 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:52, WS:204K # 0K, PF:664K # 0K, P:664K) [8] 0.001324 -0.000621 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:65, WS:260K # 0K, PF:256K # 124K, P:256K) [9] 0.000711 -0.000528 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:11, WS:44K # 0K, PF:96K # 96K, P:96K) [10] 0.000017 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [11] 0.000046 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [12] 0.000001 +J(0) [13] 0.0 +J(0) [14] 0.000006 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
853,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:47 PM,105,None,"SearchIndexer (4688,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.007768 +J(0) +M(C:0K, Fs:217, WS:848K # 848K, PF:5472K # 5472K, P:5472K) [2] 0.000475 +J(0) +M(C:10240K, Fs:102, WS:408K # 408K, PF:384K # 384K, P:384K) [3] 0.005583 +J(0) +M(C:0K, Fs:9, WS:32K # 32K, PF:68K # 68K, P:68K) [4] 0.000129 +J(0) +M(C:0K, Fs:25, WS:100K # 100K, PF:224K # 224K, P:224K) [5] 0.001173 +J(0) +M(C:0K, Fs:12, WS:48K # 48K, PF:20K # 20K, P:20K) [6] 0.001439 +J(0) +M(C:0K, Fs:29, WS:112K # 112K, PF:20K # 20K, P:20K) [7] 0.026802 +J(0) +M(C:0K, Fs:278, WS:1108K # 1108K, PF:1040K # 1040K, P:1040K) [8] - [9] - [10] - [11] - [12] - [13] 0.003531 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:9, WS:-996K # 20K, PF:-1024K # 12K, P:-1024K) [14] 0.000014 +J(0) [15] 0.000058 +J(0) +M(C:0K, Fs:32, WS:128K # 0K, PF:64K # 0K, P:64K) [16] 0.001313 +J(0) +M(C:0K, Fs:4, WS:8K # 0K, PF:0K # 0K, P:0K).  "
852,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:47 PM,916,None,"SearchIndexer (4688,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
851,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:47 PM,102,None,"SearchIndexer (4688,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
850,Application,OpenSSHd,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:46 PM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: OpenSSHd: PID 3844: `OpenSSHd' service started  "
849,Application,MSDTC 2,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:46 PM,4202,None,"Message text not available.  Insertion strings: 0 0 0 0 0 0 1 Mutual Authentication Required NT AUTHORITY\NetworkService 0 0 1  "
848,Application,sshd,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:45 PM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 4080: Server listening on 0.0.0.0 port 22.  "
847,Application,sshd,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:45 PM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 4080: Server listening on :: port 22.  "
846,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:45 PM,271,None,"Restored network configuration.  "
845,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:44 PM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
844,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:45 PM,258,None,"Restoring network configuration.  "
843,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:44 PM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
842,Application,COM+,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:44 PM,781,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\COM3\Eventlog  "
841,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:43 PM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
840,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:44 PM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
839,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/19/2017 3:47:43 PM,902,None,"The Software Protection service has started.  10.0.16299.15  "
838,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:43 PM,1037,None,"Time-based license remaining validity time 49325 minutes.  "
837,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:43 PM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 49325)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
836,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:43 PM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
835,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:43 PM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
834,Application,VMTools,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:42 PM,105,None,"The service was started.  "
833,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:41 PM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
832,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:40 PM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
831,Application,EventSystem,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:40 PM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
830,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:17 PM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
829,Application,MSDTC,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:16 PM,4111,None,"Message text not available. "
828,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:09 PM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    48 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 520 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 2768 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 764 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 7260 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\CommsAPHost\Test Process 764 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2360 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 4448 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 7260 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Explorer Process 4156 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 7260 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2360 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2360 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 4156 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 7260 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2360 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2360 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 4156 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 7260 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2360 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 7260 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 4156 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 2360 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 460 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 764 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 7260 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 4156 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2360 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2768 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2096 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections   "
827,Application,VMTools,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:09 PM,108,None,"The service was stopped.  "
826,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:09 PM,272,None,"Saved network configuration.  "
825,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:09 PM,280,None,"Saving network configuration for adapter with MAC address ?.  "
824,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:09 PM,260,None,"Saving network configuration.  "
823,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/19/2017 3:47:08 PM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
822,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/19/2017 3:45:58 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
821,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/19/2017 3:45:58 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
820,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:42:00 PM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
819,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/19/2017 3:40:31 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
818,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/19/2017 3:40:31 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
817,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/19/2017 3:40:18 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:18Z. Reason: RulesEngine.  "
816,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/19/2017 3:38:43 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
815,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/19/2017 3:38:43 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
814,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/19/2017 3:38:41 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
813,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/19/2017 3:38:41 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
812,Application,ESENT,INFORMATION,MSEDGEWIN10,12/19/2017 3:36:18 PM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
811,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/6/2017 5:27:26 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:26Z. Reason: RulesEngine.  "
810,Application,ESENT,INFORMATION,MSEDGEWIN10,12/6/2017 5:26:55 AM,916,None,"svchost (4156,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
809,Application,Puppet,ERROR,MSEDGEWIN10,12/6/2017 3:14:00 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
808,Application,Puppet,INFORMATION,MSEDGEWIN10,12/6/2017 3:13:37 AM,1,None,"Executing agent with arguments:   "
807,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/6/2017 3:12:41 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:41Z. Reason: RulesEngine.  "
806,Application,VSS,INFORMATION,MSEDGEWIN10,12/6/2017 3:10:05 AM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
805,Application,ESENT,INFORMATION,MSEDGEWIN10,12/6/2017 3:09:10 AM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
804,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/6/2017 3:07:10 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
803,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/6/2017 3:07:10 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
802,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/6/2017 3:07:08 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
801,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/6/2017 3:07:08 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
800,Application,ESENT,INFORMATION,MSEDGEWIN10,12/6/2017 3:01:39 AM,916,None,"svchost (7260,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
799,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/6/2017 3:01:09 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:52:09Z. Reason: RulesEngine.  "
798,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/6/2017 3:00:25 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
797,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/6/2017 3:00:25 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
796,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/6/2017 3:00:10 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:52:10Z. Reason: RulesEngine.  "
795,Application,ESENT,INFORMATION,MSEDGEWIN10,12/6/2017 2:59:31 AM,916,None,"svchost (4156,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
794,Application,ESENT,INFORMATION,MSEDGEWIN10,12/6/2017 2:56:51 AM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
793,Application,Puppet,ERROR,MSEDGEWIN10,12/4/2017 2:39:57 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
792,Application,Puppet,INFORMATION,MSEDGEWIN10,12/4/2017 2:39:34 AM,1,None,"Executing agent with arguments:   "
791,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/4/2017 2:38:48 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:48Z. Reason: RulesEngine.  "
790,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 2:37:29 AM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
789,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 2:29:46 AM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
788,Application,VSS,INFORMATION,MSEDGEWIN10,12/4/2017 2:29:29 AM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
787,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/4/2017 2:28:45 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
786,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/4/2017 2:28:45 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
785,Application,SpeechRuntime,UNKNOWN TYPE,MSEDGEWIN10,12/4/2017 2:27:32 AM,1,None,"Audio Orchestrator Power Event: Battery Saver Is Not Enabled, Voice Activation Ready  "
784,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/4/2017 2:26:32 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
783,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/4/2017 2:26:31 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
782,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 2:26:29 AM,326,None,"svchost (2404,D,50) DS_Token_DB: The database engine attached a database (1, C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat). (Time=0 seconds)        Saved Cache: 1 0    Additional Data: lgposAttach = 00000002:0006:0268        Internal Timing Sequence:  [1] 0.000004 +J(0) [2] 0.000928 +J(0) +M(C:0K, Fs:17, WS:4K # 4K, PF:4K # 0K, P:4K) [3] 0.008053 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:12, WS:44K # 0K, PF:40K # 0K, P:40K) [4] 0.000267 +J(0) [5] - [6] - [7] 0.000978 -0.000797 (2) CM +J(CM:2, PgRf:2, Rd:12/2, Dy:0/0, Lg:0/0) +M(C:8K, Fs:2, WS:8K # 0K, PF:8K # 0K, P:8K) [8] 0.001134 -0.000908 (2) CM +J(CM:2, PgRf:23, Rd:0/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:22, WS:88K # 76K, PF:196K # 156K, P:196K) [9] 0.000884 -0.000784 (2) CM +J(CM:2, PgRf:40, Rd:0/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 4K, PF:0K # 0K, P:0K) [10] 0.000035 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 4K, PF:0K # 0K, P:0K) [11] 0.000066 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:6, WS:24K # 24K, PF:0K # 0K, P:0K) [12] 0.000001 +J(0) [13] 0.0 +J(0) [14] 0.000006 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
781,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 2:26:29 AM,105,None,"svchost (2404,D,0) DS_Token_DB: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    lgposV2[] = 00000001:0001:0000 - 00000002:0001:0000 - 00000002:0004:0000 - 00000002:0004:0000 (00000000:0000:0000) cReInits = 1         Internal Timing Sequence:  [1] 0.001356 +J(0) +M(C:0K, Fs:133, WS:524K # 524K, PF:3416K # 3416K, P:3416K) [2] 0.000567 +J(0) +M(C:8K, Fs:128, WS:504K # 504K, PF:300K # 300K, P:300K) [3] 0.000028 +J(0) +M(C:0K, Fs:1, WS:4K # 4K, PF:64K # 64K, P:64K) [4] 0.000219 +J(0) +M(C:0K, Fs:24, WS:96K # 96K, PF:160K # 160K, P:160K) [5] 0.001448 +J(0) +M(C:0K, Fs:15, WS:60K # 60K, PF:24K # 24K, P:24K) [6] 0.003080 +J(0) +M(C:0K, Fs:31, WS:120K # 120K, PF:24K # 24K, P:24K) [7] 0.002285 +J(0) +M(C:0K, Fs:37, WS:148K # 148K, PF:64K # 64K, P:64K) [8] 0.103811 -0.084045 (236) CM +J(CM:236, PgRf:326, Rd:12/236, Dy:0/0, Lg:56553/736) +M(C:40K, Fs:182, WS:640K # 640K, PF:724K # 728K, P:724K) + 1 lgens [9] 0.007239 -0.004720 (12) CM +J(CM:12, PgRf:49, Rd:0/12, Dy:0/0, Lg:12158/110) +M(C:0K, Fs:18, WS:68K # 68K, PF:60K # 56K, P:60K) [10] 0.000753 +J(0) +M(C:0K, Fs:1, WS:-56K # 0K, PF:-60K # 0K, P:-60K) [11] 0.000032 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:49/1) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [12] 0.014445 +J(0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [13] 0.032926 -0.000619 (2) CM +J(CM:2, PgRf:2, Rd:0/2, Dy:0/0, Lg:8759/5) +M(C:0K, Fs:30, WS:-8K # 32K, PF:-32K # 0K, P:-32K) [14] 0.000014 +J(0) [15] 0.000010 +J(0) [16] 0.001413 +J(0) +M(C:0K, Fs:2, WS:0K # 0K, PF:0K # 0K, P:0K).  "
780,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 2:26:29 AM,302,None,"svchost (2404,U,0) DS_Token_DB: The database engine has successfully completed recovery steps.  "
779,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 2:26:29 AM,301,None,"svchost (2404,R,0) DS_Token_DB: The database engine has begun replaying logfile C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log.        Previous Log Processing Stats:  [1] 0.099601 -0.084045 (236) CM +J(CM:236, PgRf:326, Rd:12/236, Dy:0/0, Lg:56553/736) +M(C:40K, Fs:156, WS:544K # 544K, PF:652K # 656K, P:652K).  "
778,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 2:26:29 AM,301,None,"svchost (2404,R,0) DS_Token_DB: The database engine has begun replaying logfile C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS00001.log.        Previous Log Processing Stats: ?  "
777,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 2:26:29 AM,300,None,"svchost (2404,R,0) DS_Token_DB: The database engine is initiating recovery steps.  "
776,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 2:26:29 AM,916,None,"svchost (2404,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
775,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 2:26:29 AM,102,None,"svchost (2404,P,0) DS_Token_DB: The database engine (10.00.16299.0000) is starting a new instance (0).  "
774,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 2:26:28 AM,916,None,"svchost (4156,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
773,Application,SpeechRuntime,UNKNOWN TYPE,MSEDGEWIN10,12/4/2017 2:22:11 AM,1,None,"Audio Orchestrator Power Event: Battery Saver Is Not Enabled, Voice Activation Ready  "
772,Application,SpeechRuntime,UNKNOWN TYPE,MSEDGEWIN10,12/4/2017 2:19:22 AM,1,None,"Audio Orchestrator Power Event: Battery Saver Is Not Enabled, Voice Activation Ready  "
771,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 2:14:38 AM,916,None,"svchost (4156,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
770,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 2:14:00 AM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
769,Application,Puppet,ERROR,MSEDGEWIN10,12/4/2017 2:09:44 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
768,Application,Puppet,INFORMATION,MSEDGEWIN10,12/4/2017 2:09:21 AM,1,None,"Executing agent with arguments:   "
767,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/4/2017 2:08:43 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:43Z. Reason: RulesEngine.  "
766,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 1:59:33 AM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
765,Application,Puppet,ERROR,MSEDGEWIN10,12/4/2017 1:39:33 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
764,Application,Puppet,INFORMATION,MSEDGEWIN10,12/4/2017 1:39:09 AM,1,None,"Executing agent with arguments:   "
763,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/4/2017 1:38:37 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:37Z. Reason: RulesEngine.  "
762,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/4/2017 1:16:16 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:16Z. Reason: RulesEngine.  "
761,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/4/2017 1:16:15 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
760,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/4/2017 1:16:15 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
759,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 1:15:27 AM,916,None,"svchost (4156,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
758,Application,ESENT,INFORMATION,MSEDGEWIN10,12/4/2017 1:13:17 AM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
757,Application,Puppet,ERROR,MSEDGEWIN10,12/2/2017 7:16:59 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
756,Application,Puppet,INFORMATION,MSEDGEWIN10,12/2/2017 7:16:36 PM,1,None,"Executing agent with arguments:   "
755,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 7:16:15 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:15Z. Reason: RulesEngine.  "
754,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 6:59:59 PM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
753,Application,Puppet,ERROR,MSEDGEWIN10,12/2/2017 6:46:49 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
752,Application,Puppet,INFORMATION,MSEDGEWIN10,12/2/2017 6:46:26 PM,1,None,"Executing agent with arguments:   "
751,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 6:46:09 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:52:09Z. Reason: RulesEngine.  "
750,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 6:29:00 PM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
749,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 6:28:57 PM,916,None,"MicrosoftEdge (3492,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
748,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 6:20:34 PM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
747,Application,Puppet,ERROR,MSEDGEWIN10,12/2/2017 6:16:35 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
746,Application,Puppet,INFORMATION,MSEDGEWIN10,12/2/2017 6:16:12 PM,1,None,"Executing agent with arguments:   "
745,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 6:16:04 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:52:04Z. Reason: RulesEngine.  "
744,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 6:05:54 PM,916,None,"svchost (4404,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
743,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 6:05:13 PM,916,None,"MicrosoftEdge (1560,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
742,Application,SpeechRuntime,UNKNOWN TYPE,MSEDGEWIN10,12/2/2017 6:05:08 PM,1,None,"Audio Orchestrator Power Event: Battery Saver Is Not Enabled, Voice Activation Ready  "
741,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 6:04:59 PM,916,None,"MicrosoftEdge (2688,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
740,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,12/2/2017 6:00:34 PM,1001,None,"Fault bucket 129575400892, type 5  Event Name: RADAR_PRE_LEAK_64  Response: Not available  Cab Id: 0    Problem signature:  P1: MicrosoftEdgeCP.exe  P2: 11.0.16299.15  P3: 10.0.16299.2.0.0  P4: ?  P5: ?  P6: ?  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Users\IEUser\AppData\Local\Temp\RDRA6B7.tmp\empty.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6C7.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA734.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA773.tmp.txt    These files may be available here:  ?    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d0a96b06-abf9-4639-9b4d-c2cc4e78ee3c  Report Status: 268435456  Hashed bucket: b9e4e8d4cc510c42c7f009edb7ae72bb  "
739,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,12/2/2017 6:00:17 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=thawte Primary Root CA, OU="(c) 2006 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US> Sha1 thumbprint: <91C6D6EE3E8AC86384E548C299295C756C817B81>.  "
738,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,12/2/2017 6:00:15 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <OU=Security Communication RootCA1, O=SECOM Trust.net, C=JP> Sha1 thumbprint: <36B12B49F9819ED74C9EBC380FC6568F5DACB2F7>.  "
737,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,12/2/2017 6:00:14 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL> Sha1 thumbprint: <07E032E020B72C3F192F0628A2593A19A70F069E>.  "
736,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,12/2/2017 6:00:13 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3> Sha1 thumbprint: <D69B561148F01C77C54578C10926DF5B856976AD>.  "
735,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,12/2/2017 5:59:56 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=SecureTrust CA, O=SecureTrust Corporation, C=US> Sha1 thumbprint: <8782C6C304353BCFD29692D2593E7D44D934FF11>.  "
734,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,12/2/2017 5:59:54 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=Entrust Root Certification Authority, OU="(c) 2006 Entrust, Inc.", OU=www.entrust.net/CPS is incorporated by reference, O="Entrust, Inc.", C=US> Sha1 thumbprint: <B31EB1B740E36C8402DADC37D44DF5D4674952F9>.  "
733,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,12/2/2017 5:58:52 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US> Sha1 thumbprint: <47BEABC922EAE80E78783462A79F45C254FDE68B>.  "
732,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 5:58:34 PM,916,None,"DllHost (3632,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
731,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 5:58:31 PM,916,None,"MicrosoftEdge (5020,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
730,Application,Puppet,ERROR,MSEDGEWIN10,12/2/2017 5:46:24 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
729,Application,Puppet,INFORMATION,MSEDGEWIN10,12/2/2017 5:46:00 PM,1,None,"Executing agent with arguments:   "
728,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 5:45:58 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:58Z. Reason: RulesEngine.  "
727,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 5:31:25 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:25Z. Reason: RulesEngine.  "
726,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 5:30:53 PM,916,None,"svchost (4792,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
725,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 5:28:33 PM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
724,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 3:06:06 AM,916,None,"svchost (1376,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
723,Application,Puppet,ERROR,MSEDGEWIN10,12/2/2017 2:54:37 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
722,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:54:20 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:20Z. Reason: RulesEngine.  "
721,Application,Puppet,INFORMATION,MSEDGEWIN10,12/2/2017 2:54:14 AM,1,None,"Executing agent with arguments:   "
720,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:46:06 AM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
719,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:32:42 AM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
718,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:27:21 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:21Z. Reason: RulesEngine.  "
717,Application,VSS,INFORMATION,MSEDGEWIN10,12/2/2017 2:26:48 AM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
716,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:26:07 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:52:07Z. Reason: RulesEngine.  "
715,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/2/2017 2:25:49 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
714,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/2/2017 2:25:49 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
713,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/2/2017 2:25:47 AM,1,None,"The Windows Security Center Service has started.  "
712,Application,Puppet,ERROR,MSEDGEWIN10,12/2/2017 2:24:33 AM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
711,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/2/2017 2:24:28 AM,903,None,"The Software Protection service has stopped.    "
710,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:24:28 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-03T10:23:28Z. Reason: TBL.  "
709,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:24:19 AM,916,None,"svchost (7568,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
708,Application,Perflib,ERROR,MSEDGEWIN10,12/2/2017 2:24:04 AM,1008,None,"Message text not available.  Insertion strings: BITS C:\Windows\System32\bitsperf.dll 8  "
707,Application,Puppet,INFORMATION,MSEDGEWIN10,12/2/2017 2:24:02 AM,1,None,"Executing agent with arguments:   "
706,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:24:02 AM,1003,None,"The Windows Search Service started.   "
705,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:24:01 AM,326,None,"SearchIndexer (4200,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 0000000E:0031:0268        Internal Timing Sequence:  [1] 0.000001 +J(0) [2] 0.016713 +J(0) +M(C:0K, Fs:24, WS:32K # 0K, PF:32K # 0K, P:32K) [3] 0.027338 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:38, WS:120K # 0K, PF:136K # 0K, P:136K) [4] 0.000371 +J(0) [5] - [6] - [7] 0.043464 -0.000596 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:52, WS:204K # 0K, PF:644K # 0K, P:644K) [8] 0.006078 -0.005469 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:65, WS:260K # 0K, PF:256K # 104K, P:256K) [9] 0.000889 -0.000763 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:11, WS:44K # 0K, PF:96K # 96K, P:96K) [10] 0.000014 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [11] 0.000064 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [12] 0.000001 +J(0) [13] 0.0 +J(0) [14] 0.000006 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
704,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:24:01 AM,105,None,"SearchIndexer (4200,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.000871 +J(0) +M(C:0K, Fs:169, WS:660K # 660K, PF:4964K # 4964K, P:4964K) [2] 0.000270 +J(0) +M(C:10240K, Fs:106, WS:424K # 424K, PF:384K # 384K, P:384K) [3] 0.000023 +J(0) +M(C:0K, Fs:9, WS:32K # 32K, PF:68K # 68K, P:68K) [4] 0.000084 +J(0) +M(C:0K, Fs:28, WS:112K # 112K, PF:224K # 224K, P:224K) [5] 0.000989 +J(0) +M(C:0K, Fs:13, WS:52K # 52K, PF:20K # 20K, P:20K) [6] 0.072109 +J(0) +M(C:0K, Fs:167, WS:656K # 656K, PF:564K # 564K, P:564K) [7] 0.001808 +J(0) +M(C:0K, Fs:278, WS:1112K # 1112K, PF:1036K # 1036K, P:1036K) [8] - [9] - [10] - [11] - [12] - [13] 0.001790 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:9, WS:-996K # 20K, PF:-1020K # 12K, P:-1020K) [14] 0.000011 +J(0) [15] 0.000054 +J(0) +M(C:0K, Fs:32, WS:128K # 0K, PF:64K # 0K, P:64K) [16] 0.000180 +J(0) +M(C:0K, Fs:4, WS:8K # 0K, PF:0K # 0K, P:0K).  "
703,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:24:01 AM,916,None,"SearchIndexer (4200,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
702,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:24:01 AM,102,None,"SearchIndexer (4200,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
701,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:24:00 AM,916,None,"taskhostw (4928,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
700,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:55 AM,916,None,"svchost (2352,G,50) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
699,Application,.NET Runtime Optimization Service,UNKNOWN TYPE,MSEDGEWIN10,12/2/2017 2:23:52 AM,1130,None,".NET Runtime Optimization Service (4.0.30319.0) - Installed from repository: mscorlib  "
698,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:52 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
697,Application,.NET Runtime Optimization Service,UNKNOWN TYPE,MSEDGEWIN10,12/2/2017 2:23:52 AM,1130,None,".NET Runtime Optimization Service (4.0.30319.0) - Installed from repository: mscorlib  "
696,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:52 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
695,Application,OpenSSHd,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:47 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: OpenSSHd: PID 3828: `OpenSSHd' service started  "
694,Application,sshd,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:46 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 3892: Server listening on 0.0.0.0 port 22.  "
693,Application,sshd,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:46 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 3892: Server listening on :: port 22.  "
692,Application,Puppet,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:46 AM,1,None,"Service started  "
691,Application,MSDTC 2,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:46 AM,4202,None,"Message text not available.  Insertion strings: 0 0 0 0 0 0 1 Mutual Authentication Required NT AUTHORITY\NetworkService 0 0 1  "
690,Application,COM+,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:45 AM,781,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\COM3\Eventlog  "
689,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:45 AM,271,None,"Restored network configuration.  "
688,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:45 AM,258,None,"Restoring network configuration.  "
687,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:44 AM,916,None,"svchost (2372,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
686,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:44 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
685,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,12/2/2017 2:23:44 AM,902,None,"The Software Protection service has started.  10.0.16299.15  "
684,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:44 AM,1037,None,"Time-based license remaining validity time 74609 minutes.  "
683,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:44 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 0 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 74609)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
682,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:44 AM,1033,None,"These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=55c92734-d682-4d71-983e-d6ec3f16059f  Sku Id=3f4c0546-36c6-46a8-a37f-be13cdd0cf25  "
681,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:44 AM,1034,None,"Duplicate definition of policy found. Policy name=Security-SPP-Reserved-LicenseProperties  Priority=100  "
680,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:43 AM,916,None,"svchost (2476,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
679,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:43 AM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
678,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:43 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
677,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:43 AM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
676,Application,VMTools,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:41 AM,105,None,"The service was started.  "
675,Application,Desktop Window Manager,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:41 AM,9027,None,"The Desktop Window Manager has registered the session port.  "
674,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:39 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
673,Application,EventSystem,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:39 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
672,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:23:12 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
671,Application,VMTools,INFORMATION,MSEDGEWIN10,12/2/2017 2:22:47 AM,108,None,"The service was stopped.  "
670,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/2/2017 2:22:47 AM,272,None,"Saved network configuration.  "
669,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/2/2017 2:22:47 AM,280,None,"Saving network configuration for adapter with MAC address ?.  "
668,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,12/2/2017 2:22:47 AM,260,None,"Saving network configuration.  "
667,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:22:10 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    43 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 3444 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 2812 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 748 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 748 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2220 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 7316 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 6020 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2220 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 6020 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2220 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 6020 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 6020 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 4284 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 748 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 6020 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2812 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections   "
666,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,12/2/2017 2:22:10 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
665,Application,VSS,INFORMATION,MSEDGEWIN10,12/2/2017 2:19:55 AM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
664,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:16:54 AM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
663,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/2/2017 2:14:54 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
662,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/2/2017 2:14:54 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
661,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/2/2017 2:14:52 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
660,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/2/2017 2:14:52 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
659,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/2/2017 2:08:04 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
658,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,12/2/2017 2:08:04 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
657,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,12/2/2017 2:07:58 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:58Z. Reason: RulesEngine.  "
656,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:07:48 AM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
655,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:07:24 AM,916,None,"svchost (8128,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
654,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:07:21 AM,916,None,"svchost (6020,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
653,Application,ESENT,INFORMATION,MSEDGEWIN10,12/2/2017 2:04:25 AM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
652,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,11/30/2017 4:17:36 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:36Z. Reason: RulesEngine.  "
651,Application,VSS,INFORMATION,MSEDGEWIN10,11/30/2017 4:08:28 PM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
650,Application,ESENT,INFORMATION,MSEDGEWIN10,11/30/2017 4:05:25 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
649,Application,VSS,INFORMATION,MSEDGEWIN10,11/30/2017 4:02:18 PM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
648,Application,Microsoft-Windows-Defrag,UNKNOWN TYPE,MSEDGEWIN10,11/30/2017 3:59:51 PM,258,None,"The storage optimizer successfully completed defragmentation on Windows 10 (C:)  "
647,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 3:59:29 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
646,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 3:59:29 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
645,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 3:59:27 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
644,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 3:59:26 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
643,Application,ESENT,INFORMATION,MSEDGEWIN10,11/30/2017 3:55:03 PM,916,None,"svchost (4332,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
642,Application,ESENT,INFORMATION,MSEDGEWIN10,11/30/2017 3:52:00 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
641,Application,ESENT,INFORMATION,MSEDGEWIN10,11/30/2017 3:48:19 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
640,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,11/30/2017 3:47:31 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:31Z. Reason: RulesEngine.  "
639,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,11/30/2017 3:47:01 PM,1033,None,"These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=55c92734-d682-4d71-983e-d6ec3f16059f  Sku Id=3f4c0546-36c6-46a8-a37f-be13cdd0cf25  "
638,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,11/30/2017 3:47:01 PM,1034,None,"Duplicate definition of policy found. Policy name=Security-SPP-Reserved-LicenseProperties  Priority=100  "
637,Application,VSS,INFORMATION,MSEDGEWIN10,11/30/2017 3:10:36 PM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
636,Application,Perflib,ERROR,MSEDGEWIN10,11/30/2017 3:08:33 PM,1008,None,"Message text not available.  Insertion strings: BITS C:\Windows\System32\bitsperf.dll 8  "
635,Application,ESENT,INFORMATION,MSEDGEWIN10,11/30/2017 3:07:13 PM,916,None,"svchost (2212,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
634,Application,ESENT,INFORMATION,MSEDGEWIN10,11/30/2017 3:06:46 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
633,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,11/30/2017 3:06:00 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:52:00Z. Reason: RulesEngine.  "
632,Application,ESENT,INFORMATION,MSEDGEWIN10,11/30/2017 3:03:00 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
631,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 3:02:26 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
630,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 3:02:26 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
629,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 3:02:24 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
628,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 3:02:24 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
627,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 3:00:57 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
626,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 3:00:57 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
625,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 3:00:53 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
624,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 3:00:53 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
623,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 2:56:19 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
622,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,11/30/2017 2:56:19 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
621,Application,ESENT,INFORMATION,MSEDGEWIN10,11/30/2017 2:56:10 PM,916,None,"svchost (9908,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
620,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,11/30/2017 2:54:40 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:40Z. Reason: RulesEngine.  "
619,Application,ESENT,INFORMATION,MSEDGEWIN10,11/30/2017 2:53:51 PM,916,None,"svchost (4244,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
618,Application,ESENT,INFORMATION,MSEDGEWIN10,11/30/2017 2:53:50 PM,916,None,"svchost (8940,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
617,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,11/30/2017 2:52:06 PM,4111,None,"Successful auto update of third-party root list with effective date: ?Tuesday, ?November ?21, ?2017 12:25:07 PM.  "
616,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,11/30/2017 2:52:06 PM,4109,None,"Successful auto property update of third-party root certificate:: Subject: <CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE> Sha1 thumbprint: <B1BC968BD4F49D622AA89A81F2150152A41D829C>.  "
615,Application,ESENT,INFORMATION,MSEDGEWIN10,11/30/2017 2:51:18 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
614,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,11/30/2017 2:51:08 PM,1001,None,"Fault bucket 133563117175, type 5  Event Name: MoAppCrash  Response: Not available  Cab Id: 0    Problem signature:  P1: Microsoft.LockApp_10.0.16299.15_neutral__cw5n1h2txyewy  P2: praid:WindowsDefaultLockScreen  P3: 10.0.16299.15  P4: 59cda938  P5: StackHash12_bee  P6: 0.0.0.0  P7: 00000000  P8: 80070057  P9: 0  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9547.tmp.mdmp  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER99CD.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER99CB.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER99FB.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Microsoft.LockAp_a44465be2256285c1f95af878ed8df3f5af628_cfb8101c_a6e9b523    Analysis symbol: ?  Rechecking for solution: 0  Report Id: df749c7e-00b6-487b-99d0-eb1b75a83cbc  Report Status: 268435456  Hashed bucket: 034f6eea0fe0c268c125711b537294c2  "
613,Application,Application Error,ERROR,MSEDGEWIN10,11/30/2017 2:50:59 PM,1000,None,"Faulting application name: LockApp.exe, version: 10.0.16299.15, time stamp: 0x59cda938  Faulting module name: Windows.UI.Xaml.dll, version: 10.0.16299.15, time stamp: 0xf6706fe0  Exception code: 0xc000027b  Fault offset: 0x000000000049b07d  Faulting process id: 0x588  Faulting application start time: 0x01d34d1bad998e78  Faulting application path: C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe  Faulting module path: C:\Windows\System32\Windows.UI.Xaml.dll  Report Id: df749c7e-00b6-487b-99d0-eb1b75a83cbc  Faulting package full name: Microsoft.LockApp_10.0.16299.15_neutral__cw5n1h2txyewy  Faulting package-relative application ID: WindowsDefaultLockScreen  "
612,Application,ESENT,INFORMATION,MSEDGEWIN10,11/30/2017 2:50:52 PM,916,None,"svchost (9056,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
611,Application,ESENT,INFORMATION,MSEDGEWIN10,10/26/2017 4:07:00 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
610,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/26/2017 3:57:37 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:36Z. Reason: RulesEngine.  "
609,Application,ESENT,INFORMATION,MSEDGEWIN10,10/26/2017 3:52:20 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
608,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:41:15 PM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-26T23:40:55.563243000Z.  "
607,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:41:15 PM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{DA64A828-F7A9-4A19-97BD-3A9A63CEB972}v3.6.3150.0\pip.msi. Client Process Id: 2696.  "
606,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:41:15 PM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Python 3.6.3 pip Bootstrap (32-bit). Product Version: 3.6.3150.0. Product Language: 1033. Manufacturer: Python Software Foundation. Installation success or error status: 0.  "
605,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:41:15 PM,11707,IEUser\MSEDGEWIN10,"Product: Python 3.6.3 pip Bootstrap (32-bit) -- Installation completed successfully.  "
604,Application,ESENT,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:56 PM,916,None,"svchost (3568,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
603,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:55 PM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-26T23:40:55.563243000Z.  "
602,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:55 PM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-26T23:40:54.935980100Z.  "
601,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:55 PM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{DA64A828-F7A9-4A19-97BD-3A9A63CEB972}v3.6.3150.0\pip.msi. Client Process Id: 2696.  "
600,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:55 PM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\ProgramData\Package Cache\{C093353B-F9EE-4A06-923D-C1B340B82886}v3.6.6119.0\launcher.msi. Client Process Id: 7008.  "
599,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:55 PM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Python Launcher. Product Version: 3.6.6119.0. Product Language: 1033. Manufacturer: Python Software Foundation. Installation success or error status: 0.  "
598,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:55 PM,11707,IEUser\MSEDGEWIN10,"Product: Python Launcher -- Installation completed successfully.  "
597,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:54 PM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-26T23:40:54.935980100Z.  "
596,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:54 PM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-26T23:40:46.366016700Z.  "
595,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:54 PM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\ProgramData\Package Cache\{C093353B-F9EE-4A06-923D-C1B340B82886}v3.6.6119.0\launcher.msi. Client Process Id: 7008.  "
594,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:54 PM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{AE89BB1E-1C06-4556-AA05-A6628DE07BA9}v3.6.3150.0\tcltk.msi. Client Process Id: 2696.  "
593,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:54 PM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Python 3.6.3 Tcl/Tk Support (32-bit). Product Version: 3.6.3150.0. Product Language: 1033. Manufacturer: Python Software Foundation. Installation success or error status: 0.  "
592,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:54 PM,11707,IEUser\MSEDGEWIN10,"Product: Python 3.6.3 Tcl/Tk Support (32-bit) -- Installation completed successfully.  "
591,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:46 PM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-26T23:40:46.366016700Z.  "
590,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:46 PM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-26T23:40:45.489019100Z.  "
589,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:46 PM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{AE89BB1E-1C06-4556-AA05-A6628DE07BA9}v3.6.3150.0\tcltk.msi. Client Process Id: 2696.  "
588,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:46 PM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{6CF91DC2-CED3-410B-88BB-E048C994AA1A}v3.6.3150.0\tools.msi. Client Process Id: 2696.  "
587,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:46 PM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Python 3.6.3 Utility Scripts (32-bit). Product Version: 3.6.3150.0. Product Language: 1033. Manufacturer: Python Software Foundation. Installation success or error status: 0.  "
586,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:46 PM,11707,IEUser\MSEDGEWIN10,"Product: Python 3.6.3 Utility Scripts (32-bit) -- Installation completed successfully.  "
585,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:45 PM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-26T23:40:45.489019100Z.  "
584,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:45 PM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-26T23:40:44.989885700Z.  "
583,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:44 PM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-26T23:40:44.989885700Z.  "
582,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:44 PM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-26T23:40:38.156064900Z.  "
581,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:45 PM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{6CF91DC2-CED3-410B-88BB-E048C994AA1A}v3.6.3150.0\tools.msi. Client Process Id: 2696.  "
580,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:45 PM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{20EB04A7-B5EF-485E-9440-F36214C5501D}v3.6.3150.0\doc.msi. Client Process Id: 2696.  "
579,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:45 PM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Python 3.6.3 Documentation (32-bit). Product Version: 3.6.3150.0. Product Language: 1033. Manufacturer: Python Software Foundation. Installation success or error status: 0.  "
578,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:45 PM,11707,IEUser\MSEDGEWIN10,"Product: Python 3.6.3 Documentation (32-bit) -- Installation completed successfully.  "
577,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:44 PM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{20EB04A7-B5EF-485E-9440-F36214C5501D}v3.6.3150.0\doc.msi. Client Process Id: 2696.  "
576,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:44 PM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{63208505-67AD-4AAC-BD7B-00DE5B83BAF0}v3.6.3150.0\test.msi. Client Process Id: 2696.  "
575,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:44 PM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Python 3.6.3 Test Suite (32-bit). Product Version: 3.6.3150.0. Product Language: 1033. Manufacturer: Python Software Foundation. Installation success or error status: 0.  "
574,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:44 PM,11707,IEUser\MSEDGEWIN10,"Product: Python 3.6.3 Test Suite (32-bit) -- Installation completed successfully.  "
573,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:38 PM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-26T23:40:38.156064900Z.  "
572,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:37 PM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-26T23:40:32.735385600Z.  "
571,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:38 PM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{63208505-67AD-4AAC-BD7B-00DE5B83BAF0}v3.6.3150.0\test.msi. Client Process Id: 2696.  "
570,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:37 PM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{14843392-E9B3-4031-BCF6-FC00D5791AA8}v3.6.3150.0\lib.msi. Client Process Id: 2696.  "
569,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:37 PM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Python 3.6.3 Standard Library (32-bit). Product Version: 3.6.3150.0. Product Language: 1033. Manufacturer: Python Software Foundation. Installation success or error status: 0.  "
568,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:37 PM,11707,IEUser\MSEDGEWIN10,"Product: Python 3.6.3 Standard Library (32-bit) -- Installation completed successfully.  "
567,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:32 PM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-26T23:40:32.735385600Z.  "
566,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:32 PM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-26T23:40:32.014244400Z.  "
565,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:32 PM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-26T23:40:32.014244400Z.  "
564,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:31 PM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-26T23:40:31.199726400Z.  "
563,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:32 PM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{14843392-E9B3-4031-BCF6-FC00D5791AA8}v3.6.3150.0\lib.msi. Client Process Id: 2696.  "
562,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:32 PM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{CA16E2AA-4499-4FE5-A88C-174612920734}v3.6.3150.0\exe.msi. Client Process Id: 2696.  "
561,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:32 PM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Python 3.6.3 Executables (32-bit). Product Version: 3.6.3150.0. Product Language: 1033. Manufacturer: Python Software Foundation. Installation success or error status: 0.  "
560,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:32 PM,11707,IEUser\MSEDGEWIN10,"Product: Python 3.6.3 Executables (32-bit) -- Installation completed successfully.  "
559,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:31 PM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{CA16E2AA-4499-4FE5-A88C-174612920734}v3.6.3150.0\exe.msi. Client Process Id: 2696.  "
558,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:31 PM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{F7D9BDE7-2C35-4F7E-AEBE-9F3028451087}v3.6.3150.0\dev.msi. Client Process Id: 2696.  "
557,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:31 PM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Python 3.6.3 Development Libraries (32-bit). Product Version: 3.6.3150.0. Product Language: 1033. Manufacturer: Python Software Foundation. Installation success or error status: 0.  "
556,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:31 PM,11707,IEUser\MSEDGEWIN10,"Product: Python 3.6.3 Development Libraries (32-bit) -- Installation completed successfully.  "
555,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:31 PM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-26T23:40:31.199726400Z.  "
554,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:31 PM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-26T23:40:30.698268300Z.  "
553,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:30 PM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-26T23:40:30.698268300Z.  "
552,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:31 PM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{F7D9BDE7-2C35-4F7E-AEBE-9F3028451087}v3.6.3150.0\dev.msi. Client Process Id: 2696.  "
551,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:31 PM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{52D39C34-E5F5-41AE-88CD-5DE66C9150B4}v3.6.3150.0\core.msi. Client Process Id: 2696.  "
550,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:31 PM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Python 3.6.3 Core Interpreter (32-bit). Product Version: 3.6.3150.0. Product Language: 1033. Manufacturer: Python Software Foundation. Installation success or error status: 0.  "
549,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:31 PM,11707,IEUser\MSEDGEWIN10,"Product: Python 3.6.3 Core Interpreter (32-bit) -- Installation completed successfully.  "
548,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:30 PM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Package Cache\{52D39C34-E5F5-41AE-88CD-5DE66C9150B4}v3.6.3150.0\core.msi. Client Process Id: 2696.  "
547,Application,System Restore,INFORMATION,MSEDGEWIN10,10/26/2017 3:40:30 PM,8195,None,"System Restore has been disabled (Process = C:\Users\IEUser\AppData\Local\Temp\{DC1DA116-75AA-48CA-9F52-C6DCB40F966D}\.be\python-3.6.3.exe -q -burn.elevated BurnPipe.{BDCB1B0C-7379-4A7E-AC6F-EC76175E451D} {CFD08264-68C5-4B26-A889-E5E2A8E498BC} 2696; Volume = ?).  "
546,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/26/2017 3:39:59 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=StartCom Certification Authority, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL> Sha1 thumbprint: <3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F>.  "
545,Application,ESENT,INFORMATION,MSEDGEWIN10,10/26/2017 3:28:41 PM,916,None,"svchost (8932,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
544,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/26/2017 3:27:31 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:31Z. Reason: RulesEngine.  "
543,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/26/2017 3:18:46 PM,4115,None,"Added public key pinning rule for domain: github.com with header thumbprint: 10E267D65B17284BF31EE684C711A4D1.    Header value: max-age=5184000; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="RRM1dGqnDFsCJXBTHky16vi1obOlCgFFn/yOhI/y+ho="; pin-sha256="k2v657xBsOVe1PQRwOsHsw3bsGT2VzIqz5K+59sNQws="; pin-sha256="K87oWBWM9UZfyddvDfoxL+8lpNyoUB2ptGtn0fv6G2Q="; pin-sha256="IQBnNBEiFuhj+8x6X8XLgh01V9Ic5/V3IRQLNFFc7v4="; pin-sha256="iie1VXtL7HzAMF+/PVPR9xzT80kQxdZeJ+zduCB3uj0="; pin-sha256="LvRiGEjRqfzurezaWuj8Wie2gyHMrW5Q06LspMnox7A="; includeSubDomains.  "
542,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/26/2017 3:17:00 PM,1001,None,"Fault bucket 129575400892, type 5  Event Name: RADAR_PRE_LEAK_64  Response: Not available  Cab Id: 0    Problem signature:  P1: MicrosoftEdgeCP.exe  P2: 11.0.16299.15  P3: 10.0.16299.2.0.0  P4: ?  P5: ?  P6: ?  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Users\IEUser\AppData\Local\Temp\RDRE60B.tmp\empty.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE60C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE629.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE649.tmp.txt    These files may be available here:  ?    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 684b5d6c-a0a1-4963-a8a4-74aca77734b5  Report Status: 268435456  Hashed bucket: b9e4e8d4cc510c42c7f009edb7ae72bb  "
541,Application,ESENT,INFORMATION,MSEDGEWIN10,10/26/2017 3:06:00 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
540,Application,ESENT,INFORMATION,MSEDGEWIN10,10/26/2017 2:58:11 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
539,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/26/2017 2:57:26 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:26Z. Reason: RulesEngine.  "
538,Application,VSS,INFORMATION,MSEDGEWIN10,10/26/2017 2:48:02 PM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
537,Application,ESENT,INFORMATION,MSEDGEWIN10,10/26/2017 2:44:57 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
536,Application,ESENT,INFORMATION,MSEDGEWIN10,10/26/2017 2:35:29 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
535,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/26/2017 2:34:33 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
534,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/26/2017 2:34:33 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
533,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/26/2017 2:29:30 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
532,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/26/2017 2:29:30 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
531,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/26/2017 2:27:21 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:21Z. Reason: RulesEngine.  "
530,Application,VSS,INFORMATION,MSEDGEWIN10,10/26/2017 2:22:41 PM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
529,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/26/2017 2:21:49 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
528,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/26/2017 2:21:49 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
527,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/26/2017 2:19:43 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
526,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/26/2017 2:19:43 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
525,Application,ESENT,INFORMATION,MSEDGEWIN10,10/26/2017 2:17:00 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
524,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/26/2017 2:07:59 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
523,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/26/2017 2:07:59 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
522,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/26/2017 2:07:50 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-10-27T22:06:50Z. Reason: TBL.  "
521,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/26/2017 2:07:12 PM,8230,None,"The rules engine successfully re-evaluated the schedule.  Kernel policies:  Security-SPP-Action-StateData (REG_SZ) =AppId=55c92734-d682-4d71-983e-d6ec3f16059f;GraceEndDate=2018/01/23:05:52:12;LastConsumptionReason=0x4004fc04;LastNotificationId=Cleanup;LicenseState=SL_LICENSING_STATUS_LICENSED;PartialProductKey=YG9R6;ProductKeyType=Retail:TB:Eval;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;ruleId=379cccfb-d4e0-48fe-b0f2-0136097be147;uxDifferentiator=TIMEBASED_EVAL  "
520,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/26/2017 2:07:12 PM,1037,None,"Time-based license remaining validity time 127185 minutes.  "
519,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/26/2017 2:07:12 PM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 127185)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
518,Application,ESENT,INFORMATION,MSEDGEWIN10,10/26/2017 2:07:11 PM,916,None,"svchost (1156,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
517,Application,ESENT,INFORMATION,MSEDGEWIN10,10/26/2017 2:05:05 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
516,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/26/2017 2:04:28 PM,1001,None,"Fault bucket 128048624074, type 5  Event Name: StoreAgentScanForUpdatesFailure0  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;  P2: 8024402c  P3: 16299  P4: 19  P5: Windows.Desktop  P6: ?  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9FFB.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9FF9.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA019.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;_2587edfe71e359eb605ad9089b778b36a7285c_00000000_1f00b6ec    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 2b4d59e0-b66f-4533-b449-8515bbfabe3d  Report Status: 268435556  Hashed bucket: 8127fbfdbed71204972376cdc9268409  "
515,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/26/2017 2:04:23 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentScanForUpdatesFailure0  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;  P2: 8024402c  P3: 16299  P4: 19  P5: Windows.Desktop  P6: ?  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9FFB.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9FF9.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA019.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;_2587edfe71e359eb605ad9089b778b36a7285c_00000000_cab_12e4a028    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 2b4d59e0-b66f-4533-b449-8515bbfabe3d  Report Status: 100  Hashed bucket: ?  "
514,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/26/2017 2:04:22 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentScanForUpdatesFailure0  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;  P2: 8024402c  P3: 16299  P4: 19  P5: Windows.Desktop  P6: ?  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9FFB.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER9FF9.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA019.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;_2587edfe71e359eb605ad9089b778b36a7285c_00000000_cab_12e4a028    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 2b4d59e0-b66f-4533-b449-8515bbfabe3d  Report Status: 4  Hashed bucket: ?  "
513,Application,ESENT,INFORMATION,MSEDGEWIN10,10/26/2017 2:04:22 PM,916,None,"svchost (4852,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
512,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 2:52:09 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-23T22:21:09Z. Reason: RulesEngine.  "
511,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 2:52:00 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
510,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 2:48:50 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
509,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/24/2017 2:27:21 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2> Sha1 thumbprint: <75E0ABB6138512271C04F85FDDDE38E4B7242EFE>.  "
508,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/24/2017 2:27:19 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=GeoTrust Primary Certification Authority, O=GeoTrust Inc., C=US> Sha1 thumbprint: <323C118E1BF7B8B65254E2E2100DD6029037F096>.  "
507,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/24/2017 2:25:41 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=GeoTrust Global CA, O=GeoTrust Inc., C=US> Sha1 thumbprint: <DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212>.  "
506,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/24/2017 2:25:41 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <OU=Equifax Secure Certificate Authority, O=Equifax, C=US> Sha1 thumbprint: <D23209AD23D314232174E40D7F9D62139786633A>.  "
505,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/24/2017 2:25:35 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE> Sha1 thumbprint: <B1BC968BD4F49D622AA89A81F2150152A41D829C>.  "
504,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 2:25:35 PM,916,None,"DllHost (4912,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
503,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 2:25:32 PM,916,None,"MicrosoftEdge (8896,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
502,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 2:22:04 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-10-25T22:21:04Z. Reason: TBL.  "
501,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 2:21:34 PM,8230,None,"The rules engine successfully re-evaluated the schedule.  Kernel policies:  Security-SPP-Action-StateData (REG_SZ) =AppId=55c92734-d682-4d71-983e-d6ec3f16059f;GraceEndDate=2018/01/22:22:21:34;LastConsumptionReason=0x4004fc04;LastNotificationId=Cleanup;LicenseState=SL_LICENSING_STATUS_LICENSED;PartialProductKey=YG9R6;ProductKeyType=Retail:TB:Eval;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;ruleId=379cccfb-d4e0-48fe-b0f2-0136097be147;uxDifferentiator=TIMEBASED_EVAL  "
500,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 2:21:33 PM,1037,None,"Time-based license remaining validity time 129600 minutes.  "
499,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 2:21:33 PM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129600)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
498,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/24/2017 2:14:19 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
497,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/24/2017 2:14:19 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
496,Application,VSS,INFORMATION,MSEDGEWIN10,10/24/2017 2:07:18 PM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
495,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 2:06:38 PM,1001,None,"Fault bucket 129578632112, type 5  Event Name: RADAR_PRE_LEAK_64  Response: Not available  Cab Id: 0    Problem signature:  P1: TiWorker.exe  P2: 10.0.16299.15  P3: 10.0.16299.2.0.0  P4: ?  P5: ?  P6: ?  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Users\IEUser\AppData\Local\Temp\RDR877.tmp\empty.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER878.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER897.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8A7.tmp.txt    These files may be available here:  ?    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 17fee604-7788-4409-a79f-5fde36698ef6  Report Status: 268435456  Hashed bucket: 88d4c4cdfa94542fe09c394dc240f19a  "
494,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 2:06:17 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
493,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/24/2017 10:03:10 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
492,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/24/2017 10:03:10 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
491,Application,Microsoft-Windows-Defrag,UNKNOWN TYPE,MSEDGEWIN10,10/24/2017 10:03:09 PM,258,None,"The storage optimizer successfully completed defragmentation on Windows 10 (C:)  "
490,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 10:03:09 PM,325,None,"svchost (5256,D,0) DS_Token_DB: The database engine created a new database (1, C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat). (Time=0 seconds)        Additional Data: lgposCreate = 00000001:0001:0268        Internal Timing Sequence:  [1] 0.000087 +J(0) +M(C:0K, Fs:2, WS:8K # 8K, PF:4K # 4K, P:4K) [2] 0.001047 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:3, WS:12K # 12K, PF:0K # 0K, P:0K) [3] 0.010378 +J(0) +M(C:0K, Fs:22, WS:84K # 88K, PF:44K # 48K, P:44K) [4] 0.006525 +J(0) +M(C:0K, Fs:55, WS:216K # 212K, PF:92K # 88K, P:92K) [5] 0.000200 +J(CM:0, PgRf:3, Rd:0/0, Dy:3/6, Lg:122/4) +M(C:8K, Fs:31, WS:124K # 124K, PF:156K # 160K, P:156K) [6] 0.022936 +J(CM:0, PgRf:249, Rd:0/0, Dy:16/428, Lg:28550/465) +M(C:40K, Fs:94, WS:368K # 372K, PF:660K # 664K, P:660K) [7] 0.000923 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:4096/2) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [8] 0.000004 +J(0) [9] 0.027930 +J(0) +M(C:-24K, Fs:4, WS:-12K # 12K, PF:-24K # 0K, P:-24K) [10] 0.044073 -0.027107 (44) CM +J(CM:44, PgRf:381, Rd:0/44, Dy:16/84, Lg:12509/128) +M(C:-4K, Fs:21, WS:76K # 56K, PF:24K # 0K, P:24K) [11] 0.000003 +J(0).  "
489,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 10:03:09 PM,637,None,"svchost (5256,D,0) DS_Token_DB: New flush map file "C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm" will be created to enable persisted lost flush detection.  "
488,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 10:03:09 PM,105,None,"svchost (5256,D,0) DS_Token_DB: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.000859 +J(0) +M(C:0K, Fs:128, WS:504K # 504K, PF:2868K # 2868K, P:2868K) [2] 0.000292 +J(0) +M(C:8K, Fs:92, WS:364K # 364K, PF:304K # 304K, P:304K) [3] 0.000012 +J(0) +M(C:0K, Fs:1, WS:4K # 4K, PF:64K # 64K, P:64K) [4] 0.000113 +J(0) +M(C:0K, Fs:31, WS:120K # 120K, PF:708K # 708K, P:708K) [5] 0.001475 +J(0) +M(C:0K, Fs:54, WS:212K # 212K, PF:20K # 20K, P:20K) [6] 0.001409 +J(0) +M(C:0K, Fs:27, WS:108K # 108K, PF:16K # 16K, P:16K) [7] - [8] - [9] - [10] - [11] - [12] - [13] 0.013556 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:82, WS:264K # 300K, PF:72K # 80K, P:72K) [14] 0.000015 +J(0) [15] 0.000058 +J(0) +M(C:0K, Fs:17, WS:64K # 28K, PF:68K # 60K, P:68K) [16] 0.005859 +J(0) +M(C:0K, Fs:7, WS:20K # 20K, PF:0K # 4K, P:0K).  "
487,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 10:03:09 PM,916,None,"svchost (5256,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
486,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 10:03:09 PM,102,None,"svchost (5256,P,0) DS_Token_DB: The database engine (10.00.16299.0000) is starting a new instance (0).  "
485,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 10:00:55 PM,916,None,"svchost (2780,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
484,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 10:00:09 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:09Z. Reason: RulesEngine.  "
483,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 9:59:36 PM,916,None,"svchost (8020,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
482,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:57:56 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:56Z. Reason: RulesEngine.  "
481,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/24/2017 9:57:25 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
480,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/24/2017 9:57:25 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
479,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:57:09 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:09Z. Reason: RulesEngine.  "
478,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:55 PM,1001,None,"Fault bucket 128049726496, type 5  Event Name: StoreAgentInstallFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: L  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_13068.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC69.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC78.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC88.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_f911af168f5e57e9da8aeed90bbbc3735a53c65_00000000_199cb051    Analysis symbol: ?  Rechecking for solution: 0  Report Id: e0d8ddf7-2ae4-4b1e-8314-b594c2db11f5  Report Status: 268435456  Hashed bucket: ee5368204f6c44534fc516c6a365d1e3  "
477,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:54 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentInstallFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: L  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_13068.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC69.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC78.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC88.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_f911af168f5e57e9da8aeed90bbbc3735a53c65_00000000_cab_18b8ac69    Analysis symbol: ?  Rechecking for solution: 0  Report Id: e0d8ddf7-2ae4-4b1e-8314-b594c2db11f5  Report Status: 4  Hashed bucket: ?  "
476,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:54 PM,1001,None,"Fault bucket 128047562621, type 5  Event Name: StoreAgentInstallFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: S  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_13032.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7CEB.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7CEA.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D1A.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_45baf4404d95d9a4dfe540bb42894f89c31a2599_00000000_1fb8aa07    Analysis symbol: ?  Rechecking for solution: 0  Report Id: c8fd917a-a4b6-488a-9074-c40f64ea5b68  Report Status: 268435456  Hashed bucket: e5dd2f4099837bf3d41c33030c1574a6  "
475,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:53 PM,1001,None,"Fault bucket 128049444235, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: G  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0F4.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_f0247fde2df31132c5c0e8c187d4eed1e49da14_00000000_1fb8a600    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 5500a1d1-c1bf-477d-8e4a-c18bce81cfc6  Report Status: 268439552  Hashed bucket: 15d5491b41411f65c6438d1e7b43f714  "
474,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:51 PM,1001,None,"Fault bucket 128049741786, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 5  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12950.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER117B.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER11B8.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER11D8.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_f7f166d8dbb960af073ca5ca68e31e0aae2465f_00000000_1fb8a0c0    Analysis symbol: ?  Rechecking for solution: 0  Report Id: f843d0f4-5e8a-4cbf-9c43-479c18cad2c4  Report Status: 268435456  Hashed bucket: a643ca36c36ab9df280043662fe5a61c  "
473,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:50 PM,1001,None,"Fault bucket 128048595749, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 4  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER94AF.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_ca7a56cdd709e6b1cceb41fbd2b5fada83d496b_00000000_1fb89b81    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 36a4f230-8b34-41f5-968c-efc37b306046  Report Status: 268439552  Hashed bucket: 7b756aa5e690bb7cc71b0fe8f3b65755  "
472,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:49 PM,1001,None,"Fault bucket 128049444132, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: R  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12950.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER102F.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER103D.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER105D.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_a6e6d8525c8df25863eaecce261212d4ac55143_00000000_1fb8947c    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ff22b35c-3345-4c8d-a502-92378dd1ffb7  Report Status: 268435456  Hashed bucket: 97fdfed9ce90a77f0113763807939ee0  "
471,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:47 PM,1001,None,"Fault bucket 128048595877, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: T  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER89D0.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_9f868542173d9138940298cd516d47bcf9222_00000000_1fb88f6b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 4d5e05c2-7b62-4d3a-b319-6e5da629ad93  Report Status: 268439552  Hashed bucket: 715aae971fa3162265af3b9d2284f544  "
470,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:46 PM,1001,None,"Fault bucket 128048595749, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 4  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12950.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERED3.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF1.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF11.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_ca7a56cdd709e6b1cceb41fbd2b5fada83d496b_00000000_1fb88960    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 31d7f8c0-e1b2-4e56-9ccd-90c43d889b6d  Report Status: 268435456  Hashed bucket: 7b756aa5e690bb7cc71b0fe8f3b65755  "
469,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:45 PM,1001,None,"Fault bucket 128049443573, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 8  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER80D7.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_45f0b2ef77490a8c12df48c82d9b1e1a8b137_00000000_1fb8850b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 55940b2a-0c76-4619-bbb7-86dce8a314f1  Report Status: 268439552  Hashed bucket: 139b37dab05ea4266d971207b3626c7c  "
468,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:44 PM,1001,None,"Fault bucket 128049443679, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: N  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12950.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC5.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD4.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE04.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_131f4d44b8fb6a3a550797ba8dd8a2615cf3ceb_00000000_1fb88096    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 43154a46-c834-4127-b769-d04dda88e2aa  Report Status: 268435456  Hashed bucket: a78da08fc22614386feed1967d8c82e6  "
467,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:43 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentInstallFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: S  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_13032.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7CEB.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7CEA.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7D1A.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_45baf4404d95d9a4dfe540bb42894f89c31a2599_00000000_cab_18b87ced    Analysis symbol: ?  Rechecking for solution: 0  Report Id: c8fd917a-a4b6-488a-9074-c40f64ea5b68  Report Status: 4  Hashed bucket: ?  "
466,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:43 PM,1001,None,"Fault bucket 128048596013, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: P  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6D8C.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_a3ff1d64e6cefaa43bca8d9b309a17e78def6e_00000000_1fb87aaa    Analysis symbol: ?  Rechecking for solution: 0  Report Id: cdf47589-f394-4221-9a87-ce53b95b29d5  Report Status: 268439552  Hashed bucket: f298b30d1c207f6b8a0fd0d845ad4294  "
465,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:39 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US> Sha1 thumbprint: <A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436>.  "
464,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:40 PM,1001,None,"Fault bucket 128048595814, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 9  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12947.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC98.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA7.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC7.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_8b15bebc39565979acf316ad8b9314c1a4e685e_00000000_1fb863a8    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 8dbe4b9e-fa2b-46b3-af7b-ad918ad98cec  Report Status: 268435456  Hashed bucket: 6c9a2105c8b1b767a342fe5715d6d899  "
463,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:38 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US> Sha1 thumbprint: <5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25>.  "
462,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:36 PM,1001,None,"Fault bucket 128049444090, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: M  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12947.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBEA.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF9.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC29.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_995e10a83eae1e6f57c072f6cac26b5ead682ba_00000000_1fb851a6    Analysis symbol: ?  Rechecking for solution: 0  Report Id: e52f3f3d-81c1-4040-bcd1-6d3cb51a51e4  Report Status: 268435456  Hashed bucket: 6f28afda492c497f013ca22d480b0f74  "
461,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:34 PM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE> Sha1 thumbprint: <02FAF3E291435468607857694DF5E45B68851868>.  "
460,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:30 PM,916,None,"MicrosoftEdge (804,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
459,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:28 PM,1001,None,"Fault bucket 128048596013, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: P  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF15C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF15B.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF17B.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_a3ff1d64e6cefaa43bca8d9b309a17e78def6e_00000000_1fb83b40    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 55ebf95e-5dc3-4c9a-a2b8-d535a5613159  Report Status: 268435456  Hashed bucket: f298b30d1c207f6b8a0fd0d845ad4294  "
458,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:26 PM,1001,None,"Fault bucket 128048595749, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 4  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER296E.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_ca7a56cdd709e6b1cceb41fbd2b5fada83d496b_00000000_1fb830e0    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 493a7f8b-243f-4e74-a826-cf0a1e9fd522  Report Status: 268439552  Hashed bucket: 7b756aa5e690bb7cc71b0fe8f3b65755  "
457,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:24 PM,1001,None,"Fault bucket 128049443573, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 8  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0AC.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0BA.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0EA.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_45f0b2ef77490a8c12df48c82d9b1e1a8b137_00000000_1fb8291f    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 18d55d5d-9b07-4611-b5a2-77e34abe44d3  Report Status: 268435456  Hashed bucket: 139b37dab05ea4266d971207b3626c7c  "
456,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:21 PM,1001,None,"Fault bucket 128049444235, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: G  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF03C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF03B.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF05C.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_f0247fde2df31132c5c0e8c187d4eed1e49da14_00000000_1fb81e52    Analysis symbol: ?  Rechecking for solution: 0  Report Id: af6c2c56-9762-481b-b382-5e1347cab09c  Report Status: 268435456  Hashed bucket: 15d5491b41411f65c6438d1e7b43f714  "
455,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:20 PM,1001,None,"Fault bucket 128048595877, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: T  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFFC.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFFB.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF01B.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_9f868542173d9138940298cd516d47bcf9222_00000000_1fb817ca    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 7ed3c370-9b87-4ac0-b38e-c43c9e98da5e  Report Status: 268435456  Hashed bucket: 715aae971fa3162265af3b9d2284f544  "
454,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:19 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: G  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:?    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_f0247fde2df31132c5c0e8c187d4eed1e49da14_00000000_18b8124c    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 5500a1d1-c1bf-477d-8e4a-c18bce81cfc6  Report Status: 4100  Hashed bucket: ?  "
453,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:19 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 5  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12950.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER117B.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER11B8.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER11D8.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_f7f166d8dbb960af073ca5ca68e31e0aae2465f_00000000_cab_18b811bf    Analysis symbol: ?  Rechecking for solution: 0  Report Id: f843d0f4-5e8a-4cbf-9c43-479c18cad2c4  Report Status: 4  Hashed bucket: ?  "
452,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:18 PM,916,None,"taskhostw (4924,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
451,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:18 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 4  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:?    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_ca7a56cdd709e6b1cceb41fbd2b5fada83d496b_00000000_18b810c5    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 36a4f230-8b34-41f5-968c-efc37b306046  Report Status: 4100  Hashed bucket: ?  "
450,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:18 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: R  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12950.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER102F.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER103D.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER105D.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_a6e6d8525c8df25863eaecce261212d4ac55143_00000000_cab_18b81058    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ff22b35c-3345-4c8d-a502-92378dd1ffb7  Report Status: 4  Hashed bucket: ?  "
449,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:18 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: T  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:?    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_9f868542173d9138940298cd516d47bcf9222_00000000_18b80fbb    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 4d5e05c2-7b62-4d3a-b319-6e5da629ad93  Report Status: 4100  Hashed bucket: ?  "
448,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:18 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 4  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12950.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERED3.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF1.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF11.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_ca7a56cdd709e6b1cceb41fbd2b5fada83d496b_00000000_cab_18b80f10    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 31d7f8c0-e1b2-4e56-9ccd-90c43d889b6d  Report Status: 4  Hashed bucket: ?  "
447,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:18 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 8  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:?    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_45f0b2ef77490a8c12df48c82d9b1e1a8b137_00000000_18b80e83    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 55940b2a-0c76-4619-bbb7-86dce8a314f1  Report Status: 4100  Hashed bucket: ?  "
446,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:18 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: N  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12950.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC5.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD4.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERE04.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_131f4d44b8fb6a3a550797ba8dd8a2615cf3ceb_00000000_cab_18b80df6    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 43154a46-c834-4127-b769-d04dda88e2aa  Report Status: 4  Hashed bucket: ?  "
445,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:18 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: P  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:?    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_a3ff1d64e6cefaa43bca8d9b309a17e78def6e_00000000_18b80d5a    Analysis symbol: ?  Rechecking for solution: 0  Report Id: cdf47589-f394-4221-9a87-ce53b95b29d5  Report Status: 4100  Hashed bucket: ?  "
444,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:17 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 9  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12947.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC98.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA7.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC7.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_8b15bebc39565979acf316ad8b9314c1a4e685e_00000000_cab_18b80cbe    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 8dbe4b9e-fa2b-46b3-af7b-ad918ad98cec  Report Status: 4  Hashed bucket: ?  "
443,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:17 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: M  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12947.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBEA.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF9.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC29.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_995e10a83eae1e6f57c072f6cac26b5ead682ba_00000000_cab_18b80c22    Analysis symbol: ?  Rechecking for solution: 0  Report Id: e52f3f3d-81c1-4040-bcd1-6d3cb51a51e4  Report Status: 4  Hashed bucket: ?  "
442,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:17 PM,916,None,"taskhostw (4924,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
441,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:17 PM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
440,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:17 PM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
439,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:16 PM,1001,None,"Fault bucket 128049444132, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: R  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFAC.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFBA.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFDB.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_a6e6d8525c8df25863eaecce261212d4ac55143_00000000_1fb807ad    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 8ac21371-f21a-4119-963d-61c920d0c193  Report Status: 268435456  Hashed bucket: 97fdfed9ce90a77f0113763807939ee0  "
438,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:15 PM,1001,None,"Fault bucket 128048595749, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 4  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF5C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF5B.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF7B.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_ca7a56cdd709e6b1cceb41fbd2b5fada83d496b_00000000_1fb80403    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 1c5790d7-8aaf-4cd1-9cb1-83c27080d250  Report Status: 268435456  Hashed bucket: 7b756aa5e690bb7cc71b0fe8f3b65755  "
437,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:14 PM,1001,None,"Fault bucket 128049443679, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: N  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF0B.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF1A.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF2B.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_131f4d44b8fb6a3a550797ba8dd8a2615cf3ceb_00000000_1fbfffdd    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 0d574f5c-8d0e-4ac2-923f-a2ee3da2c1ed  Report Status: 268435456  Hashed bucket: a78da08fc22614386feed1967d8c82e6  "
436,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:13 PM,1001,None,"Fault bucket 128049444090, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: M  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12924.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEBB.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEBA.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEDB.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_995e10a83eae1e6f57c072f6cac26b5ead682ba_00000000_1fbffb59    Analysis symbol: ?  Rechecking for solution: 0  Report Id: b3c354da-2c96-4736-8d78-3d6b58a392bd  Report Status: 268435456  Hashed bucket: 6f28afda492c497f013ca22d480b0f74  "
435,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:13 PM,1001,None,"Fault bucket 128049741786, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 5  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12924.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE6B.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE7A.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE8A.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_f7f166d8dbb960af073ca5ca68e31e0aae2465f_00000000_1fbff7ce    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d10ed7b5-30d4-4d67-8b9a-d06189fcf5ba  Report Status: 268435456  Hashed bucket: a643ca36c36ab9df280043662fe5a61c  "
434,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:12 PM,1001,None,"Fault bucket 128049445614, type 5  Event Name: StoreAgentInstallFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 9  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12924.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDEC.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE1A.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE3A.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_8b15bebc39565979acf316ad8b9314c1a4e685e_00000000_1fbff3a8    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 7036de48-9008-423d-a641-8097fc7b7bf5  Report Status: 268435456  Hashed bucket: 280524ddbf7a53c0081a3ed0fa1278bd  "
433,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:11 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: P  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF15C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF15B.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF17B.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_a3ff1d64e6cefaa43bca8d9b309a17e78def6e_00000000_cab_18bff166    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 55ebf95e-5dc3-4c9a-a2b8-d535a5613159  Report Status: 4  Hashed bucket: ?  "
432,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:11 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 4  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:?    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_ca7a56cdd709e6b1cceb41fbd2b5fada83d496b_00000000_18bff118    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 493a7f8b-243f-4e74-a826-cf0a1e9fd522  Report Status: 4100  Hashed bucket: ?  "
431,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:11 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 8  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0AC.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0BA.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0EA.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_45f0b2ef77490a8c12df48c82d9b1e1a8b137_00000000_cab_18bff0d9    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 18d55d5d-9b07-4611-b5a2-77e34abe44d3  Report Status: 4  Hashed bucket: ?  "
430,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:11 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: G  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF03C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF03B.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF05C.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_f0247fde2df31132c5c0e8c187d4eed1e49da14_00000000_cab_18bff06c    Analysis symbol: ?  Rechecking for solution: 0  Report Id: af6c2c56-9762-481b-b382-5e1347cab09c  Report Status: 4  Hashed bucket: ?  "
429,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:11 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: T  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFFC.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFFB.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERF01B.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_9f868542173d9138940298cd516d47bcf9222_00000000_cab_18bff00e    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 7ed3c370-9b87-4ac0-b38e-c43c9e98da5e  Report Status: 4  Hashed bucket: ?  "
428,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:11 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: R  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFAC.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFBA.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFDB.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_a6e6d8525c8df25863eaecce261212d4ac55143_00000000_cab_18bfefd0    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 8ac21371-f21a-4119-963d-61c920d0c193  Report Status: 4  Hashed bucket: ?  "
427,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:11 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 4  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF5C.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF5B.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF7B.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_ca7a56cdd709e6b1cceb41fbd2b5fada83d496b_00000000_cab_18bfef72    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 1c5790d7-8aaf-4cd1-9cb1-83c27080d250  Report Status: 4  Hashed bucket: ?  "
426,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:11 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: N  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12927.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF0B.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF1A.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF2B.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_131f4d44b8fb6a3a550797ba8dd8a2615cf3ceb_00000000_cab_18bfef33    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 0d574f5c-8d0e-4ac2-923f-a2ee3da2c1ed  Report Status: 4  Hashed bucket: ?  "
425,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:11 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: M  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12924.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEBB.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEBA.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEDB.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_995e10a83eae1e6f57c072f6cac26b5ead682ba_00000000_cab_18bfeed6    Analysis symbol: ?  Rechecking for solution: 0  Report Id: b3c354da-2c96-4736-8d78-3d6b58a392bd  Report Status: 4  Hashed bucket: ?  "
424,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:10 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 5  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12924.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE6B.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE7A.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE8A.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_f7f166d8dbb960af073ca5ca68e31e0aae2465f_00000000_cab_18bfee97    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d10ed7b5-30d4-4d67-8b9a-d06189fcf5ba  Report Status: 4  Hashed bucket: ?  "
423,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:10 PM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentInstallFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070002  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 9  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_12924.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDEC.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE1A.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WEREE3A.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_8b15bebc39565979acf316ad8b9314c1a4e685e_00000000_cab_18bfee39    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 7036de48-9008-423d-a641-8097fc7b7bf5  Report Status: 4  Hashed bucket: ?  "
422,Application,Desktop Window Manager,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:08 PM,9027,None,"The Desktop Window Manager has registered the session port.  "
421,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:08 PM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    6 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes: Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes\Local Settings Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes\Local Settings\Software\Microsoft   "
420,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:08 PM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    47 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 540 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\SystemCertificates\CA Process 748 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\SystemCertificates Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\SystemCertificates\trust Process 748 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2220 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software Process 7316 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Explorer Process 4356 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Explorer Process 4832 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2220 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2220 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\SystemCertificates\TrustedPeople Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2220 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 4832 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2220 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 4832 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2220 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 4832 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 2220 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\SystemCertificates\Root Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\SystemCertificates\Disallowed Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache Process 464 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 748 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 4832 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2220 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Process 5628 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2220 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\SystemCertificates\SmartCardRoot Process 7908 (\Device\HarddiskVolume1\Users\IEUser\AppData\Local\Microsoft\OneDrive\OneDrive.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\AuthCookies\Live\Default   "
419,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/24/2017 9:55:08 PM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
418,Application,VSS,INFORMATION,MSEDGEWIN10,10/24/2017 9:54:19 PM,8224,None,"The VSS service is shutting down due to idle timeout.  ?  "
417,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:59 PM,916,None,"taskhostw (5492,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
416,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:56 PM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
415,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:56 PM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
414,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:51 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-24T05:51:51Z. Reason: RulesEngine.  "
413,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:26 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
412,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:26 PM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
411,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:25 PM,1003,None,"The Windows Search Service started.   "
410,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:25 PM,326,None,"SearchIndexer (2496,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 00000007:0038:0268        Internal Timing Sequence:  [1] 0.000002 +J(0) [2] 0.001449 +J(0) +M(C:0K, Fs:24, WS:32K # 0K, PF:32K # 0K, P:32K) [3] 0.080266 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:44, WS:136K # 0K, PF:144K # 0K, P:144K) [4] 0.000282 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [5] - [6] - [7] 0.023593 -0.000486 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:50, WS:200K # 0K, PF:660K # 0K, P:660K) [8] 0.022733 -0.022531 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:65, WS:260K # 0K, PF:256K # 128K, P:256K) [9] 0.000707 -0.000542 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:12, WS:44K # 0K, PF:100K # 100K, P:100K) [10] 0.000014 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [11] 0.000048 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [12] 0.000001 +J(0) [13] 0.0 +J(0) [14] 0.000006 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
409,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:25 PM,105,None,"SearchIndexer (2496,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.005576 +J(0) +M(C:0K, Fs:219, WS:856K # 856K, PF:5480K # 5480K, P:5480K) [2] 0.000641 +J(0) +M(C:10240K, Fs:103, WS:412K # 412K, PF:388K # 388K, P:388K) [3] 0.000041 +J(0) +M(C:0K, Fs:4, WS:12K # 12K, PF:68K # 68K, P:68K) [4] 0.000176 +J(0) +M(C:0K, Fs:24, WS:96K # 96K, PF:224K # 224K, P:224K) [5] 0.002434 +J(0) +M(C:0K, Fs:13, WS:52K # 52K, PF:20K # 20K, P:20K) [6] 0.011805 +J(0) +M(C:0K, Fs:37, WS:144K # 144K, PF:20K # 20K, P:20K) [7] 0.005507 +J(0) +M(C:0K, Fs:275, WS:1100K # 1100K, PF:1024K # 1024K, P:1024K) [8] - [9] - [10] - [11] - [12] - [13] 0.003086 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:9, WS:-996K # 20K, PF:-1020K # 12K, P:-1020K) [14] 0.000014 +J(0) [15] 0.000045 +J(0) +M(C:0K, Fs:32, WS:128K # 0K, PF:64K # 0K, P:64K) [16] 0.000129 +J(0) +M(C:0K, Fs:3, WS:4K # 0K, PF:0K # 0K, P:0K).  "
408,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:25 PM,916,None,"SearchIndexer (2496,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
407,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:25 PM,102,None,"SearchIndexer (2496,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
406,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:25 PM,1,None,"The Windows Security Center Service has started.  "
405,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:24 PM,900,None,"The Software Protection service is starting.  Parameters:<explicit>  "
404,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 9:53:07 PM,916,None,"svchost (5064,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
403,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,10/24/2017 9:52:31 PM,903,None,"The Software Protection service has stopped.    "
402,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:31 PM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-10-26T05:51:31Z. Reason: TBL.  "
401,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:17 PM,1001,None,"Fault bucket 128044507726, type 5  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.15  P2: 80d02013  P3: 22F64159-B786-42F2-8DEE-7F0ADD88C159  P4: Download  P5: 1  P6: 0  P7: 0  P8: Update;taskhostw  P9: {855E8A7C-ECB4-4CA3-B045-1DFA50104289}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC472.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_10.0.16299.15_03c6a6e50c6cf984f13ee38c2eb3baa8d15525_00000000_0f1502aa    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 3639225a-5cf5-49f3-95dd-ada15eb312b4  Report Status: 268435456  Hashed bucket: 286ad0bc57f4c8250c5c3a157ce70b32  "
400,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:16 PM,1001,None,"Fault bucket 128050617935, type 5  Event Name: StoreAgentDownloadFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 8024001e  P3: 16299  P4: 19  P5: Windows.Desktop  P6: M  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11883.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC441.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_2a1d6d5ced2cfff44b97dc372ecb130617a19ff_00000000_0f14fcbf    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 676be864-608b-4026-89a4-d7b1a414d7c5  Report Status: 268435456  Hashed bucket: ce3b98c78298587913300ca37104d64a  "
399,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:14 PM,1001,None,"Fault bucket 128053475231, type 5  Event Name: StoreAgentDownloadFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80080008  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 5  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11883.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC440.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_7a82395479e3ce7fdfa2844ba3156b9aad7309c_00000000_0f14f646    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 06fcd8c5-63e9-42a4-907e-51040e6a0b0e  Report Status: 268435456  Hashed bucket: 08cfab6b709e7a6916e0f584ebf5d0ce  "
398,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:13 PM,1001,None,"Fault bucket 128049225512, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 8007045b  P3: 16299  P4: 19  P5: Windows.Desktop  P6: R  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11883.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC394.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_7f9e7c829f2c5c59f81ab2fc2baf5fc8ec4bb9c_00000000_0f14f136    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 7fcea42e-0399-4ea5-95cd-1d8812351152  Report Status: 268435456  Hashed bucket: 37cf5ddee4ec2d303c268fc6ee6b9c38  "
397,Application,Puppet,ERROR,MSEDGEWIN10,10/24/2017 9:52:12 PM,3,None,"Could not request certificate: getaddrinfo: No such host is known.   "
396,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:12 PM,1001,None,"Fault bucket 128050984508, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 8007045b  P3: 16299  P4: 19  P5: Windows.Desktop  P6: G  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11883.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC373.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_29ff69f7298e3f218b4c7877ecf428b4101131_00000000_0f14ec73    Analysis symbol: ?  Rechecking for solution: 0  Report Id: db282e16-b987-417a-b952-74f0c1a191aa  Report Status: 268435456  Hashed bucket: 0c2b407c0c776edcf032e15079aabe37  "
395,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:10 PM,1001,None,"Fault bucket 128049225358, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 8007045b  P3: 16299  P4: 19  P5: Windows.Desktop  P6: N  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11883.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC353.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_73eab8327386cb2c252da99edee2873d93b86c4e_00000000_0f14e7b0    Analysis symbol: ?  Rechecking for solution: 0  Report Id: f932dac9-e323-425e-b4c8-7ce49930027a  Report Status: 268435456  Hashed bucket: 443caa0b2864d81f7e64abaae347d595  "
394,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:09 PM,1001,None,"Fault bucket 128049225631, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 8007045b  P3: 16299  P4: 19  P5: Windows.Desktop  P6: P  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11883.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC333.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_6d66e28c5796299e7c1e63c9fef125679248240_00000000_0f14e232    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d96001cc-7e58-479c-bb74-f147be2918d7  Report Status: 268435456  Hashed bucket: e53ec086bf0683ef3e69c2d549a9f167  "
393,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:08 PM,1001,None,"Fault bucket 128049225111, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 8007045b  P3: 16299  P4: 19  P5: Windows.Desktop  P6: L  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11883.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC313.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_8438d0deb2e439cbad29c720e056f8a0cb909ce9_00000000_0f14dc75    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 63d76176-562b-402c-8109-117e02aea21e  Report Status: 268435456  Hashed bucket: 92bfa97bfd1fedbba9c251c96d4d1bf3  "
392,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:06 PM,1001,None,"Fault bucket 128049225480, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 8007045b  P3: 16299  P4: 19  P5: Windows.Desktop  P6: T  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11883.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC2F2.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_fc60867edbc0ffc4975e88d42c4c71d6363820_00000000_0f14d60c    Analysis symbol: ?  Rechecking for solution: 0  Report Id: ded7a0b2-ac9d-40b0-a643-17d13b9e8d14  Report Status: 268435456  Hashed bucket: 215cf96417505a24dfd4572f0f3c1cbe  "
391,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:05 PM,1001,None,"Fault bucket 128049224925, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 8007045b  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 9  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11883.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC2D2.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_c62c1d723d57992ea334ff9a201aa199669332_00000000_0f14d188    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 44276dc0-cd5d-44b4-9d61-fb87e436a65c  Report Status: 268435456  Hashed bucket: 2b4b14e2c42aea064d0aafc66230027a  "
390,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:04 PM,1001,None,"Fault bucket 128049225422, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 8007045b  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 4  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8BE.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_654c237d37d4113159c2a588a0c2c10cb3b4743_00000000_0f14cc68    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 55f49e38-4ea6-4495-8cfb-1fcd435c8421  Report Status: 268439552  Hashed bucket: 71b39e269c9a5b1ce9219760dac8a8e8  "
389,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:02 PM,1001,None,"Fault bucket 128049225036, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 8007045b  P3: 16299  P4: 19  P5: Windows.Desktop  P6: J  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11883.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC292.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_38697381ceb345ddba2ca3d4331e2ede593a4252_00000000_0f14c812    Analysis symbol: ?  Rechecking for solution: 0  Report Id: f15e4642-a210-43d1-abf5-6d6b7f681493  Report Status: 268435456  Hashed bucket: 04cc6d00446e3352d43214c56c2d7bd6  "
388,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:01 PM,8197,None,"SLUI.exe was launched with the following command-line parameters:  RuleId=379cccfb-d4e0-48fe-b0f2-0136097be147;Action=CleanupState;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;Trigger=TimerEvent  "
387,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:01 PM,8230,None,"The rules engine successfully re-evaluated the schedule.  Kernel policies:  Security-SPP-Action-StateData (REG_SZ) =AppId=55c92734-d682-4d71-983e-d6ec3f16059f;GraceEndDate=2018/01/23:05:52:01;LastConsumptionReason=0x4004fc04;LastNotificationId=Cleanup;LicenseState=SL_LICENSING_STATUS_LICENSED;PartialProductKey=YG9R6;ProductKeyType=Retail:TB:Eval;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;ruleId=379cccfb-d4e0-48fe-b0f2-0136097be147;uxDifferentiator=TIMEBASED_EVAL  "
386,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:01 PM,8197,None,"SLUI.exe was launched with the following command-line parameters:  RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;NotificationInterval=1440;Trigger=TimerEvent  "
385,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:01 PM,1037,None,"Time-based license remaining validity time 129600 minutes.  "
384,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:01 PM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129600)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
383,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:01 PM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129600)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
382,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:01 PM,1001,None,"Fault bucket 128049224636, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 8007045b  P3: 16299  P4: 19  P5: Windows.Desktop  P6: S  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11883.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC262.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_678084253557a88c11ca4a02965b2afeb8ec2_00000000_0f14beeb    Analysis symbol: ?  Rechecking for solution: 0  Report Id: d57e9404-44c9-4b87-aaf3-b3095db5668e  Report Status: 268435456  Hashed bucket: 33598cb5b4d3d08db9202f0d90fa6029  "
381,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:00 PM,1033,None,"These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=55c92734-d682-4d71-983e-d6ec3f16059f  Sku Id=3f4c0546-36c6-46a8-a37f-be13cdd0cf25  "
380,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:00 PM,1034,None,"Duplicate definition of policy found. Policy name=Security-SPP-Reserved-LicenseProperties  Priority=100  "
379,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:00 PM,1036,None,"Validity period has been started. Validity minutes=129600  Grace type=9.  "
378,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:52:00 PM,12311,None,"The MSA client has been successfully triggered to update the Device License  "
377,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:59 PM,1001,None,"Fault bucket 128049225422, type 5  Event Name: StoreAgentSearchUpdatePackagesFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 8007045b  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 4  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11883.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1E4.tmp.WERInternalMetadata.xml    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_654c237d37d4113159c2a588a0c2c10cb3b4743_00000000_0f14b517    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 45f80e08-a79f-481b-9344-cb69cfeea064  Report Status: 268435456  Hashed bucket: 71b39e269c9a5b1ce9219760dac8a8e8  "
376,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:58 PM,12304,None,"Successfully acquired genuine ticket for template Id {99d92734-d682-4d71-983e-d6ec3f16059f}  "
375,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:58 PM,12305,None,"Genuine state set to genuine for application Id 55c92734-d682-4d71-983e-d6ec3f16059f  "
374,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:57 PM,20489,None,"Genuine validation data collection ended.     "
373,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:57 PM,1034,None,"Duplicate definition of policy found. Policy name=Security-SPP-WriteWauMarker  Priority=500  "
372,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:56 PM,20482,None,"Health check passed.     "
371,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:56 PM,20481,None,"Health check initiated.     "
370,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:55 PM,20488,None,"Genuine validation data collection started.     "
369,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:54 PM,1001,None,"Fault bucket 128050329459, type 5  Event Name: StoreAgentDownloadFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80d02013  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 8  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11879.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBFFE.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC013.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC024.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_5b6e243a8d1c7c279668dffb3eb9a8a38b62c214_00000000_0f14a1be    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 2fce38db-9799-4a9f-b09d-45011643b17f  Report Status: 268435456  Hashed bucket: 617e61309c4fda35450007f40c6623c7  "
368,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:53 PM,1067,None,"Genuine information set for application. 0x00000000, 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, SL_ACTIVATION_VALIDATION_IN_PROGRESS.    "
367,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:53 PM,1004,None,"The Software Protection service has successfully installed the license.  License Title=XrML 2.1 License - {msft:sl/EUL/ACTIVATED/PRIVATE}  License Id=1153feea-3fdf-4528-9db1-bf2cd4ca3aa9  "
366,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:53 PM,1004,None,"The Software Protection service has successfully installed the license.  License Title=XrML 2.1 License - {msft:sl/EUL/ACTIVATED/PUBLIC}  License Id=05207959-b293-43b9-bcde-6ac0137566a6  "
365,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,10/24/2017 9:51:53 PM,1013,None,"Acquisition of End User License was successful.  Sku Id=3f4c0546-36c6-46a8-a37f-be13cdd0cf25  "
364,Application,Perflib,ERROR,MSEDGEWIN10,10/24/2017 9:51:46 PM,1008,None,"Message text not available.  Insertion strings: BITS C:\Windows\System32\bitsperf.dll 8  "
363,Application,Puppet,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:45 PM,1,None,"Executing agent with arguments:   "
362,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:42 PM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 )(1 )(2 )(3 [0x00000000, 0, 0], [( 6 0xC004F009 0 0)( 1 0x00000000)( 6 0xC004F009 0 0)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)( 11 0x00000000 0xC004F009)])]    "
361,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:40 PM,8230,None,"The rules engine successfully re-evaluated the schedule.  Kernel policies:  Security-SPP-Action-StateData (REG_SZ) =AppId=55c92734-d682-4d71-983e-d6ec3f16059f;LastConsumptionReason=0xc004f009;LastNotificationId=NeverActivated;LicenseState=SL_LICENSING_STATUS_NOTIFICATION;PartialProductKey=YG9R6;ProductKeyType=Retail:TB:Eval;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;ruleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;uxDifferentiator=TIMEBASED_EVAL  "
360,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:38 PM,8230,None,"The rules engine successfully re-evaluated the schedule.  Kernel policies:  Security-SPP-Action-StateData (REG_SZ) =AppId=55c92734-d682-4d71-983e-d6ec3f16059f;LastConsumptionReason=0xc004f009;LastNotificationId=NeverActivated;LicenseState=SL_LICENSING_STATUS_NOTIFICATION;PartialProductKey=YG9R6;ProductKeyType=Retail:TB:Eval;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;ruleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;uxDifferentiator=TIMEBASED_EVAL  "
359,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:33 PM,916,None,"svchost (4832,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
358,Application,Puppet,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:31 PM,1,None,"Service started  "
357,Application,OpenSSHd,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:31 PM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: OpenSSHd: PID 3632: `OpenSSHd' service started  "
356,Application,MSDTC 2,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:30 PM,4202,None,"Message text not available.  Insertion strings: 0 0 0 0 0 0 1 Mutual Authentication Required NT AUTHORITY\NetworkService 0 0 1  "
355,Application,sshd,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:30 PM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 2884: Server listening on 0.0.0.0 port 22.  "
354,Application,sshd,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:30 PM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 2884: Server listening on :: port 22.  "
353,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:29 PM,916,None,"svchost (2212,G,50) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
352,Application,COM+,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:28 PM,781,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\COM3\Eventlog  "
351,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:27 PM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
350,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:28 PM,271,None,"Restored network configuration.  "
349,Application,WLMS,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:28 PM,100,None,"Message text not available. "
348,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,10/24/2017 9:51:28 PM,902,None,"The Software Protection service has started.  10.0.16299.15  "
347,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:28 PM,258,None,"Restoring network configuration.  "
346,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:28 PM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 0 [(0 )(1 )(2 )(3 [0x00000000, 0, 0], [( 6 0xC004F009 0 0)( 1 0x00000000)( 6 0xC004F009 0 0)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)( 11 0x00000000 0xC004F009)])]    "
345,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:27 PM,1034,None,"Duplicate definition of policy found. Policy name=Security-SPP-WriteWauMarker  Priority=500  "
344,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:27 PM,8226,None,"The existing scheduler data is incomplete.  The schedule will be re-evaluated.  Reason:0xC004D304  "
343,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:27 PM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
342,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:26 PM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
341,Application,ESENT,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:26 PM,916,None,"svchost (2228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
340,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:26 PM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
339,Application,VMTools,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:24 PM,105,None,"The service was started.  "
338,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:22 PM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
337,Application,EventSystem,INFORMATION,MSEDGEWIN10,10/24/2017 9:51:22 PM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
336,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:32 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
335,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:31 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    1 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes: Process 1872 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\Schemas   "
334,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:31 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    42 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 492 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 768 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 768 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 4828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 5688 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Explorer Process 1548 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 1548 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 1548 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 1548 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 436 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 768 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 1548 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2272 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process 2828 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections   "
333,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:31 AM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentDownloadFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80d02013  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 8  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11879.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERBFFE.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC013.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERC024.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_5b6e243a8d1c7c279668dffb3eb9a8a38b62c214_00000000_cab_0eeec04b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 2fce38db-9799-4a9f-b09d-45011643b17f  Report Status: 4  Hashed bucket: ?  "
332,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:31 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-16T18:13:31Z. Reason: RulesEngine.  "
331,Application,VMTools,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:31 AM,108,None,"The service was stopped.  "
330,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:31 AM,272,None,"Saved network configuration.  "
329,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:31 AM,280,None,"Saving network configuration for adapter with MAC address 00:0C:29:11:3E:52.  "
328,Application,VMUpgradeHelper,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:31 AM,260,None,"Saving network configuration.  "
327,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:31 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
326,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:11 AM,1001,None,"Fault bucket 128053149075, type 5  Event Name: StoreAgentInstallFailure1  Response: Not available  Cab Id: 126230439268    Problem signature:  P1: Update;taskhostw  P2: 80070070  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 2  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11798.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CAF.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CB3.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CD4.tmp.txt  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.111333.090.1.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.111333.090.2.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.111427.719.1.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.111511.676.1.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.111511.676.2.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.111511.676.3.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.112339.099.1.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.112814.097.1.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.114153.707.1.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.114153.707.2.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.114153.707.3.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.114153.707.4.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.114153.707.5.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.114153.707.6.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.114153.707.7.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.114153.707.8.etl  \\?\C:\Windows\logs\windowsupdate\WindowsUpdate.20171017.114153.707.9.etl  \\?\C:\Windows\softwaredistribution\ReportingEvents.log  \\?\C:\Windows\system32\winevt\logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx  \\?\C:\Windows\system32\winevt\logs\Microsoft-Windows-Store%4Operational.evtx  \\?\C:\Windows\system32\winevt\logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx  \\?\C:\Windows\Temp\WER6402.tmp.WERDataCollectionStatus.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_Update;taskhostw_a18b116d6683425a5b6fb44d229ebf9bf53107d_00000000_cab_07be6f5d    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 9f296fa9-762c-4bf5-9d78-1f9633b35858  Report Status: 268435464  Hashed bucket: ec8140e81dc2a0e1f662d15c8b020079  "
325,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:06 AM,1001,None,"Fault bucket ?, type 0  Event Name: StoreAgentInstallFailure1  Response: Not available  Cab Id: 0    Problem signature:  P1: Update;taskhostw  P2: 80070070  P3: 16299  P4: 19  P5: Windows.Desktop  P6: 2  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\FailureReportMetadata_11798.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CAF.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CB3.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CD4.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Update;taskhostw_a18b116d6683425a5b6fb44d229ebf9bf53107d_00000000_cab_0eee5cde    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 9f296fa9-762c-4bf5-9d78-1f9633b35858  Report Status: 4  Hashed bucket: ?  "
324,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:05 AM,1001,None,"Fault bucket 50, type 5  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.15  P2: 80070070  P3: 9992EB7F-0D87-4DD3-A9F6-5E862A1B74B0  P4: Install  P5: 1  P6: 0  P7: 0  P8: Update;taskhostw  P9: {855E8A7C-ECB4-4CA3-B045-1DFA50104289}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER50A9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER50BB.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER50CC.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_10.0.16299.15_d8d1712df78783498c61282297113ba929e14e_00000000_10d659f0    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 659b07d0-c9a8-42ff-8f11-b51cec90bd30  Report Status: 268435456  Hashed bucket: 38c36f8ddc248f15ef1023f178c20f61  "
323,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:04 AM,1001,None,"Fault bucket 128046188097, type 5  Event Name: AppxDeploymentFailureBlue  Response: Not available  Cab Id: 126230439140    Problem signature:  P1: 80070070  P2: 17  P3: 3  P4: windows.runTime  P5: 10.0.16299.15  P6: 7001  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\AppXDeploymentServer_7BB10FD0-4775-0001-6F9F-B87B7547D301.evtx  \\?\C:\Windows\TEMP\AppXPackaging_7BB10FD0-4775-0001-6F9F-B87B7547D301.evtx  \\?\C:\Windows\TEMP\AppxErrorReport_7BB10FD0-4775-0001-6F9F-B87B7547D301.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER460B.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4659.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4698.tmp.txt  \\?\C:\Windows\Temp\WER50D8.tmp.WERDataCollectionStatus.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_80070070_dac34c132c27f8f5d8f4d8276f7502d544174ad_00000000_cab_10d6559b    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 1869fe98-be2e-4a8d-83c2-010ca162e078  Report Status: 268435464  Hashed bucket: 2bda1edad1e8607e1c922cac698e9bcc  "
322,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:03 AM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.15  P2: 80070070  P3: 9992EB7F-0D87-4DD3-A9F6-5E862A1B74B0  P4: Install  P5: 1  P6: 0  P7: 0  P8: Update;taskhostw  P9: {855E8A7C-ECB4-4CA3-B045-1DFA50104289}  P10: 0    Attached files:  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER50A9.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER50BB.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER50CC.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_10.0.16299.15_d8d1712df78783498c61282297113ba929e14e_00000000_cab_0f2a50d8    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 659b07d0-c9a8-42ff-8f11-b51cec90bd30  Report Status: 4  Hashed bucket: ?  "
321,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:03 AM,1001,None,"Fault bucket ?, type 0  Event Name: WindowsUpdateFailure3  Response: Not available  Cab Id: 0    Problem signature:  P1: 10.0.16299.15  P2: 80070070  P3: 9992EB7F-0D87-4DD3-A9F6-5E862A1B74B0  P4: Install  P5: 1  P6: 0  P7: 0  P8: Update;taskhostw  P9: {855E8A7C-ECB4-4CA3-B045-1DFA50104289}  P10: 0    Attached files:?    These files may be available here:  ?    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 659b07d0-c9a8-42ff-8f11-b51cec90bd30  Report Status: 1074003968  Hashed bucket: ?  "
320,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:01 AM,12306,None,"Rearm successful for AppId = 55c92734-d682-4d71-983e-d6ec3f16059f, SkuId = (null) - 1 Rearms Remaining.  "
319,Application,Windows Error Reporting,INFORMATION,MSEDGEWIN10,10/17/2017 11:26:00 AM,1001,None,"Fault bucket ?, type 0  Event Name: AppxDeploymentFailureBlue  Response: Not available  Cab Id: 0    Problem signature:  P1: 80070070  P2: 17  P3: 3  P4: windows.runTime  P5: 10.0.16299.15  P6: 7001  P7: ?  P8: ?  P9: ?  P10: ?    Attached files:  \\?\C:\Windows\TEMP\AppXDeploymentServer_7BB10FD0-4775-0001-6F9F-B87B7547D301.evtx  \\?\C:\Windows\TEMP\AppXPackaging_7BB10FD0-4775-0001-6F9F-B87B7547D301.evtx  \\?\C:\Windows\TEMP\AppxErrorReport_7BB10FD0-4775-0001-6F9F-B87B7547D301.txt  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER460B.tmp.WERInternalMetadata.xml  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4659.tmp.csv  \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER4698.tmp.txt    These files may be available here:  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_80070070_dac34c132c27f8f5d8f4d8276f7502d544174ad_00000000_cab_076646b6    Analysis symbol: ?  Rechecking for solution: 0  Report Id: 1869fe98-be2e-4a8d-83c2-010ca162e078  Report Status: 4  Hashed bucket: ?  "
318,Application,Puppet,ERROR,MSEDGEWIN10,10/17/2017 10:57:47 AM,3,None,"Could not request certificate: No connection could be made because the target machine actively refused it. - connect(2)  "
317,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:57:22 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-16T18:13:22Z. Reason: RulesEngine.  "
316,Application,Puppet,INFORMATION,MSEDGEWIN10,10/17/2017 10:57:16 AM,1,None,"Executing agent with arguments:   "
315,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:56:52 AM,1033,None,"These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=55c92734-d682-4d71-983e-d6ec3f16059f  Sku Id=3f4c0546-36c6-46a8-a37f-be13cdd0cf25  "
314,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:56:52 AM,1034,None,"Duplicate definition of policy found. Policy name=Security-SPP-Reserved-LicenseProperties  Priority=100  "
313,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:41:53 AM,916,None,"svchost (1548,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
312,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:37:13 AM,916,None,"svchost (2264,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
311,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:35:03 AM,916,None,"svchost (5688,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
310,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/17/2017 10:31:16 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
309,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/17/2017 10:31:16 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
308,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/17/2017 10:31:14 AM,1,None,"The Windows Security Center Service has started.  "
307,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:30:13 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-16T18:13:13Z. Reason: RulesEngine.  "
306,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:29:03 AM,900,None,"The Software Protection service is starting.  Parameters:<explicit>  "
305,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:14 AM,916,None,"svchost (6948,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
304,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:08 AM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-17T18:28:07.504036200Z.  "
303,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:07 AM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-17T18:28:07.504036200Z.  "
302,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:08 AM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Windows\Temp\7z920.msi. Client Process Id: 5692.  "
301,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:08 AM,1034,IEUser\MSEDGEWIN10,"Windows Installer removed the product. Product Name: 7-Zip 9.20. Product Version: 9.20.00.0. Product Language: 1033. Manufacturer: Igor Pavlov. Removal success or error status: 0.  "
300,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:08 AM,11724,IEUser\MSEDGEWIN10,"Product: 7-Zip 9.20 -- Removal completed successfully.  "
299,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:07 AM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Windows\Temp\7z920.msi. Client Process Id: 5692.  "
298,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:04 AM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=DST Root CA X3, O=Digital Signature Trust Co.> Sha1 thumbprint: <DAC9024F54D8F6DF94935FB1732638CA6AD77C13>.  "
297,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:01 AM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-17T18:28:01.332267000Z.  "
296,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:01 AM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-17T18:28:01.332267000Z.  "
295,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:01 AM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Windows\Temp\7z920.msi. Client Process Id: 1736.  "
294,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:01 AM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: 7-Zip 9.20. Product Version: 9.20.00.0. Product Language: 1033. Manufacturer: Igor Pavlov. Installation success or error status: 0.  "
293,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:01 AM,11707,IEUser\MSEDGEWIN10,"Product: 7-Zip 9.20 -- Installation completed successfully.  "
292,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:01 AM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Windows\Temp\7z920.msi. Client Process Id: 1736.  "
291,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:00 AM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-17T18:27:59.957217800Z.  "
290,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:59 AM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-17T18:27:59.957217800Z.  "
289,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:00 AM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Windows\Temp\7z920.msi. Client Process Id: 460.  "
288,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:00 AM,1034,IEUser\MSEDGEWIN10,"Windows Installer removed the product. Product Name: 7-Zip 9.20. Product Version: 9.20.00.0. Product Language: 1033. Manufacturer: Igor Pavlov. Removal success or error status: 0.  "
287,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:28:00 AM,11724,IEUser\MSEDGEWIN10,"Product: 7-Zip 9.20 -- Removal completed successfully.  "
286,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:59 AM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Windows\Temp\7z920.msi. Client Process Id: 460.  "
285,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:59 AM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Temp\{D2236796-832D-4E8C-A337-0C6EEB8ACB27}~setup\VMware Tools64.msi. Client Process Id: 6928.  "
284,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:59 AM,1029,IEUser\MSEDGEWIN10,"Product: VMware Tools. Restart required. The installation or update for the product required a restart for all changes to take effect.  The restart was deferred to a later time.  "
283,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:59 AM,1038,IEUser\MSEDGEWIN10,"Windows Installer requires a system restart. Product Name: VMware Tools. Product Version: 10.1.6.5214329. Product Language: 1033. Manufacturer: VMware, Inc.. Type of System Restart: 2. Reason for Restart: 4.  "
282,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:59 AM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: VMware Tools. Product Version: 10.1.6.5214329. Product Language: 1033. Manufacturer: VMware, Inc.. Installation success or error status: 0.  "
281,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:59 AM,11707,IEUser\MSEDGEWIN10,"Product: VMware Tools -- Installation completed successfully.  "
280,Application,MSDTC 2,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:57 AM,4202,None,"Message text not available.  Insertion strings: 0 0 0 0 0 0 1 Mutual Authentication Required NT AUTHORITY\NetworkService 0 0 1  "
279,Application,COM+,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:56 AM,781,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\COM3\Eventlog  "
278,Application,VMTools,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:55 AM,105,None,"The service was started.  "
277,Application,Puppet,ERROR,MSEDGEWIN10,10/17/2017 10:27:45 AM,3,None,"Could not request certificate: No connection could be made because the target machine actively refused it. - connect(2)  "
276,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:40 AM,916,None,"svchost (2280,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
275,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:32 AM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-17T18:27:32.332500500Z.  "
274,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:32 AM,10002,IEUser\MSEDGEWIN10,"Shutting down application or service 'Print Spooler'.  "
273,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:32 AM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-17T18:27:32.332500500Z.  "
272,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:30 AM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Temp\{D2236796-832D-4E8C-A337-0C6EEB8ACB27}~setup\VMware Tools64.msi. Client Process Id: 6928.  "
271,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:28 AM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-17T18:27:26.676095000Z.  "
270,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:28 AM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: c:\444bc79117a58abd3e6b0efdc0\vc_red.msi. Client Process Id: 7124.  "
269,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:28 AM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161. Product Version: 9.0.30729.6161. Product Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 0.  "
268,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:28 AM,11707,IEUser\MSEDGEWIN10,"Product: Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 -- Installation completed successfully.  "
267,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:26 AM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-17T18:27:26.676095000Z.  "
266,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:26 AM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: c:\444bc79117a58abd3e6b0efdc0\vc_red.msi. Client Process Id: 7124.  "
265,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,10/17/2017 10:27:24 AM,903,None,"The Software Protection service has stopped.    "
264,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:24 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-10-18T18:26:24Z. Reason: TBL.  "
263,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:22 AM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-17T18:27:19.254980900Z.  "
262,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:22 AM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: c:\f66e130970fc8960d9cc8d082919e9\vc_red.msi. Client Process Id: 7052.  "
261,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:22 AM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161. Product Version: 9.0.30729.6161. Product Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 0.  "
260,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:22 AM,11707,IEUser\MSEDGEWIN10,"Product: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 -- Installation completed successfully.  "
259,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:19 AM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-17T18:27:19.254980900Z.  "
258,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:19 AM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: c:\f66e130970fc8960d9cc8d082919e9\vc_red.msi. Client Process Id: 7052.  "
257,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:15 AM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-17T18:27:14.816726900Z.  "
256,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:14 AM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-17T18:27:14.816726900Z.  "
255,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:15 AM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Windows\Temp\7z920.msi. Client Process Id: 3888.  "
254,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:15 AM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: 7-Zip 9.20. Product Version: 9.20.00.0. Product Language: 1033. Manufacturer: Igor Pavlov. Installation success or error status: 0.  "
253,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:15 AM,11707,IEUser\MSEDGEWIN10,"Product: 7-Zip 9.20 -- Installation completed successfully.  "
252,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:14 AM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Windows\Temp\7z920.msi. Client Process Id: 3888.  "
251,Application,Puppet,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:09 AM,1,None,"Executing agent with arguments:   "
250,Application,sshd,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:03 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 6428: Accepted password for IEUser from 192.168.108.1 port 63227 ssh2  "
249,Application,sshd,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:03 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 6400: Did not receive identification string from 192.168.108.1  "
248,Application,OpenSSHd,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:03 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: OpenSSHd: PID 3592: `OpenSSHd' service started  "
247,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:03 AM,1003,None,"The Windows Search Service started.   "
246,Application,sshd,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:02 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 2944: Server listening on 0.0.0.0 port 22.  "
245,Application,sshd,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:02 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 2944: Server listening on :: port 22.  "
244,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:01 AM,326,None,"SearchIndexer (4540,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 00000006:00B4:0268        Internal Timing Sequence:  [1] 0.000002 +J(0) [2] 0.002326 +J(0) +M(C:0K, Fs:32, WS:64K # 0K, PF:44K # 0K, P:44K) [3] 0.046521 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:53, WS:176K # 0K, PF:144K # 0K, P:144K) [4] 0.001163 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [5] - [6] - [7] 0.036761 -0.000515 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:54, WS:212K # 0K, PF:664K # 0K, P:664K) [8] 0.001121 -0.000894 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:67, WS:268K # 0K, PF:256K # 148K, P:256K) [9] 0.000655 -0.000546 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:11, WS:44K # 0K, PF:96K # 96K, P:96K) [10] 0.000013 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [11] 0.000044 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [12] 0.000001 +J(0) [13] 0.0 +J(0) [14] 0.000005 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
243,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:01 AM,105,None,"SearchIndexer (4540,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.001892 +J(0) +M(C:0K, Fs:216, WS:852K # 852K, PF:5472K # 5472K, P:5472K) [2] 0.000252 +J(0) +M(C:10240K, Fs:103, WS:408K # 408K, PF:384K # 384K, P:384K) [3] 0.000017 +J(0) +M(C:0K, Fs:3, WS:12K # 12K, PF:64K # 64K, P:64K) [4] 0.000105 +J(0) +M(C:0K, Fs:25, WS:96K # 96K, PF:228K # 228K, P:228K) [5] 0.001597 +J(0) +M(C:0K, Fs:12, WS:48K # 48K, PF:20K # 20K, P:20K) [6] 0.003903 +J(0) +M(C:0K, Fs:36, WS:144K # 144K, PF:16K # 16K, P:16K) [7] 0.004030 +J(0) +M(C:0K, Fs:279, WS:1112K # 1112K, PF:1028K # 1028K, P:1028K) [8] - [9] - [10] - [11] - [12] - [13] 0.002622 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:9, WS:-996K # 20K, PF:-1020K # 12K, P:-1020K) [14] 0.000015 +J(0) [15] 0.000067 +J(0) +M(C:0K, Fs:33, WS:128K # 0K, PF:64K # 0K, P:64K) [16] 0.000177 +J(0) +M(C:0K, Fs:3, WS:4K # 0K, PF:0K # 0K, P:0K).  "
242,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:01 AM,916,None,"SearchIndexer (4540,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
241,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:27:01 AM,102,None,"SearchIndexer (4540,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
240,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:58 AM,916,None,"taskhostw (4024,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
239,Application,Puppet,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:53 AM,1,None,"Service started  "
238,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:51 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
237,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:52 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
236,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:52 AM,916,None,"svchost (2280,G,50) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
235,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,10/17/2017 10:26:51 AM,902,None,"The Software Protection service has started.  10.0.16299.15  "
234,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:51 AM,1037,None,"Time-based license remaining validity time 129587 minutes.  "
233,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:51 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129587)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
232,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:51 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
231,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:51 AM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
230,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:50 AM,916,None,"svchost (2264,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
229,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:50 AM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
228,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:49 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
227,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:48 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
226,Application,EventSystem,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:48 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
225,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:31 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
224,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:30 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    13 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 492 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 728 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 728 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2364 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 2364 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2364 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 2364 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2364 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 2364 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2364 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 436 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 728 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 2364 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security   "
223,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:31 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
222,Application,OpenSSHd,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:24 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: OpenSSHd: PID 6912: `OpenSSHd' service stopped, exit status: 0  "
221,Application,sshd,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:24 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 6428: Received signal 15; terminating.  "
220,Application,OpenSSHd,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:23 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: OpenSSHd: PID 6912: `OpenSSHd' service started  "
219,Application,sshd,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:19 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 6428: Server listening on 0.0.0.0 port 2222.  "
218,Application,sshd,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:19 AM,0,sshd_server\MSEDGEWIN10,"Message text not available.  Insertion strings: sshd: PID 6428: Server listening on :: port 2222.  "
217,Application,Windows Search Service Profile Notification,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:18 AM,5,None,"Windows Search Service has created default configuration for new user 'MSEDGEWIN10\sshd_server' .  "
216,Application,Puppet,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:15 AM,1,None,"Executing agent with arguments:   "
215,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:02 AM,1003,None,"The Windows Search Service started.   "
214,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:01 AM,326,None,"SearchIndexer (5932,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 00000006:003D:0268        Internal Timing Sequence:  [1] 0.000002 +J(0) [2] 0.003929 +J(0) +M(C:0K, Fs:24, WS:32K # 0K, PF:32K # 0K, P:32K) [3] 0.024520 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:44, WS:136K # 0K, PF:144K # 0K, P:144K) [4] 0.000192 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [5] - [6] - [7] 0.030582 -0.000473 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:54, WS:216K # 0K, PF:660K # 0K, P:660K) [8] 0.000608 -0.000406 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:67, WS:268K # 0K, PF:256K # 128K, P:256K) [9] 0.000530 -0.000425 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:11, WS:44K # 0K, PF:96K # 96K, P:96K) [10] 0.000013 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [11] 0.000045 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [12] 0.000001 +J(0) [13] 0.0 +J(0) [14] 0.000005 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
213,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:01 AM,105,None,"SearchIndexer (5932,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.001050 +J(0) +M(C:0K, Fs:196, WS:764K # 764K, PF:5476K # 5476K, P:5476K) [2] 0.000261 +J(0) +M(C:10240K, Fs:124, WS:496K # 496K, PF:380K # 380K, P:380K) [3] 0.000019 +J(0) +M(C:0K, Fs:4, WS:12K # 12K, PF:68K # 68K, P:68K) [4] 0.000088 +J(0) +M(C:0K, Fs:27, WS:108K # 108K, PF:232K # 232K, P:232K) [5] 0.001240 +J(0) +M(C:0K, Fs:11, WS:44K # 44K, PF:20K # 20K, P:20K) [6] 0.019095 +J(0) +M(C:0K, Fs:37, WS:144K # 144K, PF:20K # 20K, P:20K) [7] 0.002255 +J(0) +M(C:0K, Fs:277, WS:1108K # 1108K, PF:1024K # 1024K, P:1024K) [8] - [9] - [10] - [11] - [12] - [13] 0.001945 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:10, WS:-992K # 24K, PF:-1020K # 12K, P:-1020K) [14] 0.000016 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [15] 0.000048 +J(0) +M(C:0K, Fs:32, WS:128K # 0K, PF:64K # 0K, P:64K) [16] 0.000188 +J(0) +M(C:0K, Fs:3, WS:4K # 0K, PF:0K # 0K, P:0K).  "
212,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:01 AM,916,None,"SearchIndexer (5932,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
211,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:26:01 AM,102,None,"SearchIndexer (5932,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
210,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,10/17/2017 10:25:58 AM,902,None,"The Software Protection service has started.  10.0.16299.15  "
209,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:58 AM,1037,None,"Time-based license remaining validity time 129588 minutes.  "
208,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:58 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129588)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
207,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:57 AM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
206,Application,Puppet,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:57 AM,1,None,"Service started  "
205,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:56 AM,916,None,"taskhostw (3692,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
204,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:53 AM,916,None,"svchost (2392,G,50) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
203,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:51 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
202,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:50 AM,916,None,"svchost (2400,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
201,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:50 AM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
200,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:49 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
199,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:50 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
198,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:49 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
197,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:48 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
196,Application,EventSystem,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:48 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
195,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:30 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
194,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:29 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    15 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 492 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 728 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 728 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2180 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 6988 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 6896 (\Device\HarddiskVolume1\Windows\System32\msiexec.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Explorer Process 2180 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2180 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 2180 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2180 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 2180 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2180 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 436 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 728 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 2180 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security   "
193,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:30 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
192,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:26 AM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-17T18:25:06.426012500Z.  "
191,Application,Puppet,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:27 AM,1,None,"Service started  "
190,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:26 AM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Temp\chocolatey\puppet\3.8.7\puppet-3.8.7-x64.msi. Client Process Id: 6860.  "
189,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:26 AM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Puppet (64-bit). Product Version: 3.8.7. Product Language: 1033. Manufacturer: Puppet Labs. Installation success or error status: 0.  "
188,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:26 AM,11707,IEUser\MSEDGEWIN10,"Product: Puppet (64-bit) -- Installation completed successfully.  "
187,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:06 AM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-17T18:25:06.426012500Z.  "
186,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:06 AM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=VeriSign Universal Root Certification Authority, OU="(c) 2008 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US> Sha1 thumbprint: <3679CA35668772304D30A5FB873B0FA77BB70D54>.  "
185,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:05 AM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=thawte Primary Root CA - G3, OU="(c) 2008 thawte, Inc. - For authorized use only", OU=Certification Services Division, O="thawte, Inc.", C=US> Sha1 thumbprint: <F18B538D1BE903B6A6F056435B171589CAF36BF2>.  "
184,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:05 AM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: C:\Users\IEUser\AppData\Local\Temp\chocolatey\puppet\3.8.7\puppet-3.8.7-x64.msi. Client Process Id: 6860.  "
183,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:25:00 AM,4097,None,"Successful auto update of third-party root certificate:: Subject: <OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US> Sha1 thumbprint: <AD7E1C28B064EF8F6003402014C3D0E3370EB58A>.  "
182,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,10/17/2017 10:24:56 AM,903,None,"The Software Protection service has stopped.    "
181,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:56 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-10-18T18:23:56Z. Reason: TBL.  "
180,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:40 AM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US> Sha1 thumbprint: <0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43>.  "
179,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:40 AM,4111,None,"Successful auto update of third-party root list with effective date: ?Friday, ?September ?22, ?2017 8:57:10 AM.  "
178,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:40 AM,4108,None,"Successful auto delete of third-party root certificate:: Subject: <OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US> Sha1 thumbprint: <4F65566336DB6598581D584A596C87934D5F2AB4>.  "
177,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:40 AM,4109,None,"Successful auto property update of third-party root certificate:: Subject: <OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US> Sha1 thumbprint: <742C3192E607E424EB4549542BE1BBC53E6174E2>.  "
176,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:40 AM,4109,None,"Successful auto property update of third-party root certificate:: Subject: <CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE> Sha1 thumbprint: <D4DE20D05E66FC53FE1A50882C78DB2852CAE474>.  "
175,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:38 AM,4097,None,"Successful auto update of third-party root certificate:: Subject: <OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US> Sha1 thumbprint: <2796BAE63F1801E277261BA0D77770028F20EEE4>.  "
174,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:31 AM,1003,None,"The Windows Search Service started.   "
173,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:31 AM,326,None,"SearchIndexer (5428,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 00000006:000B:0268        Internal Timing Sequence:  [1] 0.000086 +J(0) [2] 0.002809 +J(0) +M(C:0K, Fs:24, WS:32K # 0K, PF:32K # 0K, P:32K) [3] 0.019007 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:44, WS:144K # 0K, PF:140K # 0K, P:140K) [4] 0.000191 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [5] - [6] - [7] 0.028057 -0.000710 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:55, WS:216K # 0K, PF:664K # 0K, P:664K) [8] 0.000893 -0.000680 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:67, WS:268K # 0K, PF:256K # 132K, P:256K) [9] 0.000748 -0.000539 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:11, WS:44K # 0K, PF:96K # 96K, P:96K) [10] 0.000013 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [11] 0.000081 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [12] 0.000002 +J(0) [13] 0.0 +J(0) [14] 0.000006 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
172,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:31 AM,105,None,"SearchIndexer (5428,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.001487 +J(0) +M(C:0K, Fs:217, WS:852K # 852K, PF:5476K # 5476K, P:5476K) [2] 0.000637 +J(0) +M(C:10240K, Fs:101, WS:404K # 404K, PF:380K # 380K, P:380K) [3] 0.000024 +J(0) +M(C:0K, Fs:4, WS:12K # 12K, PF:68K # 68K, P:68K) [4] 0.000091 +J(0) +M(C:0K, Fs:25, WS:96K # 96K, PF:228K # 228K, P:228K) [5] 0.003494 +J(0) +M(C:0K, Fs:22, WS:88K # 88K, PF:28K # 28K, P:28K) [6] 0.004529 +J(0) +M(C:0K, Fs:36, WS:144K # 144K, PF:16K # 16K, P:16K) [7] 0.005339 +J(0) +M(C:0K, Fs:285, WS:1136K # 1136K, PF:1028K # 1028K, P:1028K) [8] - [9] - [10] - [11] - [12] - [13] 0.003018 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:9, WS:-996K # 20K, PF:-1020K # 12K, P:-1020K) [14] 0.000023 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:4K # 0K, P:4K) [15] 0.000074 +J(0) +M(C:0K, Fs:33, WS:128K # 0K, PF:64K # 0K, P:64K) [16] 0.000377 +J(0) +M(C:0K, Fs:3, WS:4K # 0K, PF:0K # 0K, P:0K).  "
171,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:31 AM,916,None,"SearchIndexer (5428,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
170,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:31 AM,102,None,"SearchIndexer (5428,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
169,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:28 AM,916,None,"taskhostw (3368,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
168,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:27 AM,916,None,"svchost (2172,G,50) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
167,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:24 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
166,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:24 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
165,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:23 AM,916,None,"svchost (2188,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
164,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,10/17/2017 10:24:23 AM,902,None,"The Software Protection service has started.  10.0.16299.15  "
163,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:23 AM,1037,None,"Time-based license remaining validity time 129590 minutes.  "
162,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:23 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129590)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
161,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:22 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
160,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:23 AM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
159,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:23 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
158,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:22 AM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
157,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:21 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
156,Application,EventSystem,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:21 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
155,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:05 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
154,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:04 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    20 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 488 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 744 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 744 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2268 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 4276 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 6092 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2268 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2268 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 6092 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2268 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2268 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 6092 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2268 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 6092 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 2268 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 432 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 744 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 6092 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2268 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2268 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections   "
153,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:24:04 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
152,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:39 AM,916,None,"svchost (6092,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
151,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:24 AM,1003,None,"The Windows Search Service started.   "
150,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:23 AM,326,None,"SearchIndexer (5556,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 00000005:00F0:0268        Internal Timing Sequence:  [1] 0.000003 +J(0) [2] 0.001693 +J(0) +M(C:0K, Fs:24, WS:32K # 0K, PF:32K # 0K, P:32K) [3] 0.022673 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:43, WS:140K # 0K, PF:140K # 0K, P:140K) [4] 0.000208 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [5] - [6] - [7] 0.016391 -0.000482 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:53, WS:208K # 0K, PF:664K # 0K, P:664K) [8] 0.001238 -0.001034 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:67, WS:268K # 0K, PF:256K # 132K, P:256K) [9] 0.000636 -0.000528 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:11, WS:44K # 0K, PF:96K # 96K, P:96K) [10] 0.000013 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [11] 0.000046 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [12] 0.000001 +J(0) [13] 0.0 +J(0) [14] 0.000005 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
149,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:23 AM,105,None,"SearchIndexer (5556,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.007146 +J(0) +M(C:0K, Fs:222, WS:868K # 868K, PF:5476K # 5476K, P:5476K) [2] 0.000300 +J(0) +M(C:10240K, Fs:101, WS:404K # 404K, PF:380K # 380K, P:380K) [3] 0.000024 +J(0) +M(C:0K, Fs:4, WS:12K # 12K, PF:68K # 68K, P:68K) [4] 0.000095 +J(0) +M(C:0K, Fs:24, WS:96K # 96K, PF:224K # 224K, P:224K) [5] 0.001210 +J(0) +M(C:0K, Fs:12, WS:48K # 48K, PF:20K # 20K, P:20K) [6] 0.004652 +J(0) +M(C:0K, Fs:37, WS:144K # 144K, PF:20K # 20K, P:20K) [7] 0.009787 +J(0) +M(C:0K, Fs:275, WS:1100K # 1100K, PF:1024K # 1024K, P:1024K) [8] - [9] - [10] - [11] - [12] - [13] 0.006041 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:10, WS:-992K # 24K, PF:-1020K # 12K, P:-1020K) [14] 0.000022 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:4K # 0K, P:4K) [15] 0.000043 +J(0) +M(C:0K, Fs:32, WS:128K # 0K, PF:64K # 0K, P:64K) [16] 0.000150 +J(0) +M(C:0K, Fs:3, WS:4K # 0K, PF:0K # 0K, P:0K).  "
148,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:23 AM,916,None,"SearchIndexer (5556,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
147,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:23 AM,102,None,"SearchIndexer (5556,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
146,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:20 AM,916,None,"taskhostw (4036,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
145,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:15 AM,916,None,"svchost (2276,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
144,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:11 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
143,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:10 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
142,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:07 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
141,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,10/17/2017 10:23:06 AM,902,None,"The Software Protection service has started.  10.0.16299.15  "
140,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:06 AM,1037,None,"Time-based license remaining validity time 129591 minutes.  "
139,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:06 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 0 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129591)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
138,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:06 AM,1033,None,"These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=55c92734-d682-4d71-983e-d6ec3f16059f  Sku Id=3f4c0546-36c6-46a8-a37f-be13cdd0cf25  "
137,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:06 AM,1034,None,"Duplicate definition of policy found. Policy name=Security-SPP-Reserved-LicenseProperties  Priority=100  "
136,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:05 AM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
135,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:04 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
134,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:05 AM,916,None,"svchost (2288,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
133,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:04 AM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
132,Application,Desktop Window Manager,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:03 AM,9027,None,"The Desktop Window Manager has registered the session port.  "
131,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:02 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
130,Application,EventSystem,INFORMATION,MSEDGEWIN10,10/17/2017 10:23:02 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
129,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:22:41 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
128,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:22:04 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    5 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes: Process 6048 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes Process 6048 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes Process 6048 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes Process 6048 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes\Local Settings Process 6048 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000_Classes\Local Settings\Software\Microsoft   "
127,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:22:04 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    27 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 488 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 764 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 6048 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\CommsAPHost\Test Process 764 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2204 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 4544 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 6048 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Explorer Process 5208 (\Device\HarddiskVolume1\Windows\System32\msiexec.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Explorer Process 2712 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 6048 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2204 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2204 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 6048 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Process 2204 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 2712 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 6048 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2204 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 2712 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 6048 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 2204 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Main Process 6048 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Unified Store\HighWaterMarks\C:_Users_IEUser_AppData_Local_Comms_UnistoreDB_store.vol Process 432 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 764 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children Process 2712 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 6048 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 2204 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Internet Explorer\Security Process 3728 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections   "
126,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:22:04 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
125,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/17/2017 10:20:58 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
124,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/17/2017 10:20:58 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
123,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:20:26 AM,916,None,"svchost (2220,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
122,Application,Perflib,ERROR,MSEDGEWIN10,10/17/2017 10:20:22 AM,1008,None,"Message text not available.  Insertion strings: BITS C:\Windows\System32\bitsperf.dll 8  "
121,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:19:21 AM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-17T18:18:30.490024800Z.  "
120,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:19:21 AM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}. Client Process Id: 452.  "
119,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:19:21 AM,1035,IEUser\MSEDGEWIN10,"Windows Installer reconfigured the product. Product Name: Microsoft Silverlight. Product Version: 5.1.50907.0. Product Language: 1033. Manufacturer: Microsoft Corporation. Reconfiguration success or error status: 0.  "
118,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:19:21 AM,11728,IEUser\MSEDGEWIN10,"Product: Microsoft Silverlight -- Configuration completed successfully.  "
117,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:19:21 AM,1036,IEUser\MSEDGEWIN10,"Windows Installer installed an update. Product Name: Microsoft Silverlight. Product Version: 5.1.50907.0. Product Language: 1033. Manufacturer: Microsoft Corporation. Update Name: Microsoft Silverlight 5.1.50907.0. Installation success or error status: 0.  "
116,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:19:21 AM,1022,IEUser\MSEDGEWIN10,"Product: Microsoft Silverlight - Update 'Microsoft Silverlight 5.1.50907.0' installed successfully.  "
115,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:18:30 AM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-17T18:18:30.490024800Z.  "
114,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:18:30 AM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}. Client Process Id: 452.  "
113,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:18:29 AM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US> Sha1 thumbprint: <4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5>.  "
112,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:18:28 AM,10001,IEUser\MSEDGEWIN10,"Ending session 0 started 2017-10-17T18:18:28.208041500Z.  "
111,Application,Microsoft-Windows-RestartManager,INFORMATION,MSEDGEWIN10,10/17/2017 10:18:28 AM,10000,IEUser\MSEDGEWIN10,"Starting session 0 - 2017-10-17T18:18:28.208041500Z.  "
110,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:18:28 AM,1042,SYSTEM\NT AUTHORITY,"Ending a Windows Installer transaction: c:\11b662ed18c8399ed79e\Silverlight.msi. Client Process Id: 452.  "
109,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:18:28 AM,1033,IEUser\MSEDGEWIN10,"Windows Installer installed the product. Product Name: Microsoft Silverlight. Product Version: 1.0.0.0. Product Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 0.  "
108,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:18:28 AM,11707,IEUser\MSEDGEWIN10,"Product: Microsoft Silverlight -- Installation completed successfully.  "
107,Application,MsiInstaller,INFORMATION,MSEDGEWIN10,10/17/2017 10:18:28 AM,1040,IEUser\MSEDGEWIN10,"Beginning a Windows Installer transaction: c:\11b662ed18c8399ed79e\Silverlight.msi. Client Process Id: 452.  "
106,Application,System Restore,INFORMATION,MSEDGEWIN10,10/17/2017 10:18:26 AM,8195,None,"System Restore has been disabled (Process = c:\windows\system32\svchost.exe -k netsvcs; Volume = ?).  "
105,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:17:22 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-16T18:13:22Z. Reason: RulesEngine.  "
104,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:17:13 AM,916,None,"svchost (6048,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
103,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/17/2017 10:16:53 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
102,Application,SecurityCenter,ERROR,MSEDGEWIN10,10/17/2017 10:16:53 AM,16,None,"Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.  "
101,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/17/2017 10:16:53 AM,15,None,"Updated Windows Defender status successfully to SECURITY_PRODUCT_STATE_ON.  "
100,Application,SecurityCenter,ERROR,MSEDGEWIN10,10/17/2017 10:16:52 AM,16,None,"Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.  "
099,Application,SecurityCenter,INFORMATION,MSEDGEWIN10,10/17/2017 10:16:50 AM,1,None,"The Windows Security Center Service has started.  "
098,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:16:50 AM,900,None,"The Software Protection service is starting.  Parameters:<explicit>  "
097,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:16:44 AM,4113,None,"Successful auto update of pin rules with effective date: ?Wednesday, ?May ?31, ?2017 4:28:59 PM.  "
096,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:16:43 AM,916,None,"svchost (4636,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
095,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:16:14 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-12-16T18:13:14Z. Reason: RulesEngine.  "
094,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,10/17/2017 10:15:24 AM,903,None,"The Software Protection service has stopped.    "
093,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:15:24 AM,16384,None,"Successfully scheduled Software Protection service for re-start at 2017-10-18T18:14:24Z. Reason: TBL.  "
092,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:15:11 AM,916,None,"svchost (2712,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
091,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:59 AM,1003,None,"The Windows Search Service started.   "
090,Application,Windows Search Service Profile Notification,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:59 AM,1,None,"Windows Search Service indexed data for user 'S-1-5-21-4233833229-2203495600-2027003190-1001' successfully removed in response to user profile deletion.  "
089,Application,Windows Search Service Profile Notification,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:59 AM,1,None,"Windows Search Service indexed data for user 'S-1-5-21-4233833229-2203495600-2027003190-1001' successfully removed in response to user profile deletion.  "
088,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:58 AM,326,None,"SearchIndexer (5496,D,50) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)        Saved Cache: 0 0    Additional Data: lgposAttach = 00000003:00C0:0268        Internal Timing Sequence:  [1] 0.000003 +J(0) [2] 0.061489 +J(0) +M(C:0K, Fs:24, WS:32K # 0K, PF:32K # 0K, P:32K) [3] 0.086029 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:3480/2) +M(C:0K, Fs:53, WS:180K # 0K, PF:164K # 0K, P:164K) [4] 0.000253 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [5] - [6] - [7] 0.029547 -0.001005 (2) CM +J(CM:2, PgRf:2, Rd:16/2, Dy:0/0, Lg:0/0) +M(C:0K, Fs:51, WS:200K # 0K, PF:644K # 0K, P:644K) [8] 0.000831 -0.000466 (5) CM +J(CM:5, PgRf:23, Rd:0/5, Dy:0/0, Lg:0/0) +M(C:0K, Fs:67, WS:268K # 0K, PF:256K # 136K, P:256K) [9] 0.000817 -0.000708 (1) CM +J(CM:1, PgRf:40, Rd:0/1, Dy:0/0, Lg:0/0) +M(C:0K, Fs:11, WS:44K # 0K, PF:96K # 96K, P:96K) [10] 0.000013 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:1, WS:4K # 0K, PF:0K # 0K, P:0K) [11] 0.000369 +J(CM:0, PgRf:42, Rd:0/0, Dy:0/0, Lg:0/0) +M(C:0K, Fs:4, WS:16K # 0K, PF:0K # 0K, P:0K) [12] 0.000002 +J(0) [13] 0.0 +J(0) [14] 0.000008 +J(CM:0, PgRf:1, Rd:0/0, Dy:0/0, Lg:0/0).  "
087,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:58 AM,105,None,"SearchIndexer (5496,D,0) Windows: The database engine started a new instance (0). (Time=0 seconds)        Additional Data:    ?        Internal Timing Sequence:  [1] 0.006996 +J(0) +M(C:0K, Fs:233, WS:920K # 920K, PF:5472K # 5472K, P:5472K) [2] 0.000347 +J(0) +M(C:10240K, Fs:100, WS:396K # 396K, PF:376K # 376K, P:376K) [3] 0.000021 +J(0) +M(C:0K, Fs:4, WS:12K # 12K, PF:68K # 68K, P:68K) [4] 0.000084 +J(0) +M(C:0K, Fs:24, WS:96K # 96K, PF:224K # 224K, P:224K) [5] 0.001209 +J(0) +M(C:0K, Fs:12, WS:48K # 48K, PF:20K # 20K, P:20K) [6] 0.007710 +J(0) +M(C:0K, Fs:36, WS:144K # 144K, PF:16K # 16K, P:16K) [7] 0.048442 +J(0) +M(C:0K, Fs:278, WS:1108K # 1108K, PF:1028K # 1028K, P:1028K) [8] - [9] - [10] - [11] - [12] - [13] 0.003008 +J(CM:0, PgRf:0, Rd:0/0, Dy:0/0, Lg:616/1) +M(C:0K, Fs:9, WS:-996K # 20K, PF:-1020K # 12K, P:-1020K) [14] 0.000020 +J(0) +M(C:0K, Fs:1, WS:4K # 0K, PF:4K # 0K, P:4K) [15] 0.000049 +J(0) +M(C:0K, Fs:33, WS:128K # 0K, PF:64K # 0K, P:64K) [16] 0.000192 +J(0) +M(C:0K, Fs:3, WS:4K # 0K, PF:0K # 0K, P:0K).  "
086,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:57 AM,916,None,"SearchIndexer (5496,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
085,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:57 AM,102,None,"SearchIndexer (5496,P,0) Windows: The database engine (10.00.16299.0000) is starting a new instance (0).  "
084,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:55 AM,916,None,"taskhostw (3584,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
083,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:54 AM,916,None,"svchost (2220,G,50) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
082,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:52 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
081,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:51 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
080,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:51 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
079,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,10/17/2017 10:14:50 AM,902,None,"The Software Protection service has started.  10.0.16299.15  "
078,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:50 AM,1037,None,"Time-based license remaining validity time 129599 minutes.  "
077,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:50 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129599)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
076,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:50 AM,1066,None,"Initialization status for service objects.  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/inherited/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/detect, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/ActionScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/statecollector/pkey, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/activationinfo/1.0, 0x00000000, 0x00000000   "
075,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:50 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
074,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:50 AM,916,None,"svchost (2212,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
073,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:50 AM,900,None,"The Software Protection service is starting.  Parameters:TriggerStarted:6  "
072,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:48 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
071,Application,EventSystem,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:48 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
070,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:33 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
069,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:32 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    9 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1000: Process 7080 (\Device\HarddiskVolume1\Windows\System32\winlogon.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000 Process 756 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Parents Process 756 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore Process 2724 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\CloudContent Process 5044 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 2724 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows\CurrentVersion\Privacy Process 2724 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Policies\Microsoft\Windows\DataCollection Process 7028 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 756 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1000\System\GameConfigStore\Children   "
068,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:32 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
067,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:14:27 AM,916,None,"svchost (4632,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
066,Application,ESENT,ERROR,MSEDGEWIN10,10/17/2017 10:14:08 AM,522,None,"ShellExperienceHost (6660,P,0) TILEREPOSITORYS-1-5-21-4233833229-2203495600-2027003190-1000: An attempt to open the device with name "\\.\C:" containing "C:\" failed with system error 5 (0x00000005): "Access is denied. ". The operation will fail with error -1032 (0xfffffbf8).  "
065,Application,ESENT,ERROR,MSEDGEWIN10,10/17/2017 10:14:08 AM,522,None,"ShellExperienceHost (6660,P,0) TILEREPOSITORYS-1-5-21-4233833229-2203495600-2027003190-1000: An attempt to open the device with name "\\.\C:" containing "C:\" failed with system error 5 (0x00000005): "Access is denied. ". The operation will fail with error -1032 (0xfffffbf8).  "
064,Application,ESENT,ERROR,MSEDGEWIN10,10/17/2017 10:14:08 AM,522,None,"ShellExperienceHost (6660,P,0) TILEREPOSITORYS-1-5-21-4233833229-2203495600-2027003190-1000: An attempt to open the device with name "\\.\C:" containing "C:\" failed with system error 5 (0x00000005): "Access is denied. ". The operation will fail with error -1032 (0xfffffbf8).  "
063,Application,ESENT,ERROR,MSEDGEWIN10,10/17/2017 10:14:08 AM,522,None,"ShellExperienceHost (6660,P,0) TILEREPOSITORYS-1-5-21-4233833229-2203495600-2027003190-1000: An attempt to open the device with name "\\.\C:" containing "C:\" failed with system error 5 (0x00000005): "Access is denied. ". The operation will fail with error -1032 (0xfffffbf8).  "
062,Application,ESENT,ERROR,MSEDGEWIN10,10/17/2017 10:14:08 AM,522,None,"ShellExperienceHost (6660,P,0) TILEREPOSITORYS-1-5-21-4233833229-2203495600-2027003190-1000: An attempt to open the device with name "\\.\C:" containing "C:\" failed with system error 5 (0x00000005): "Access is denied. ". The operation will fail with error -1032 (0xfffffbf8).  "
061,Application,ESENT,ERROR,MSEDGEWIN10,10/17/2017 10:14:08 AM,522,None,"ShellExperienceHost (6660,P,0) TILEREPOSITORYS-1-5-21-4233833229-2203495600-2027003190-1000: An attempt to open the device with name "\\.\C:" containing "C:\" failed with system error 5 (0x00000005): "Access is denied. ". The operation will fail with error -1032 (0xfffffbf8).  "
060,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:55 AM,916,None,"taskhostw (6096,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
059,Application,Microsoft-Windows-User Profiles Service,WARNING,MSEDGEWIN10,10/17/2017 10:13:51 AM,1534,SYSTEM\NT AUTHORITY,"Profile notification of event Create for component {2c86c843-77ae-4284-9722-27d65366543c} failed, error code is Not implemented  .       "
058,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:52 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
057,Application,Windows Search Service Profile Notification,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:51 AM,5,None,"Windows Search Service has created default configuration for new user 'MSEDGEWIN10\IEUser' .  "
056,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:51 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
055,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:51 AM,1530,SYSTEM\NT AUTHORITY,"Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. No user action is required.       DETAIL -    20 user registry handles leaked from \Registry\User\S-1-5-21-4233833229-2203495600-2027003190-1001: Process 756 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\System\GameConfigStore\Parents Process 756 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\System\GameConfigStore Process 2724 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Policies\Microsoft\Windows\CloudContent Process 5044 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall Process 4284 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2724 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 3464 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process 2724 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Microsoft\Windows\CurrentVersion\Privacy Process 2724 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Policies\Microsoft\Windows\DataCollection Process 2724 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 3464 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 4284 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Process 3464 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Microsoft\Internet Explorer\Main Process 4284 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Microsoft\Internet Explorer\Main Process 2724 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Microsoft\Internet Explorer\Main Process 440 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Microsoft\Windows NT\CurrentVersion\Fonts Process 756 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\System\GameConfigStore\Children Process 3464 (<Unknown>) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Microsoft\Internet Explorer\Security Process 4284 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Microsoft\Internet Explorer\Security Process 2724 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-4233833229-2203495600-2027003190-1001\Software\Microsoft\Internet Explorer\Security   "
054,Application,Desktop Window Manager,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:51 AM,9027,None,"The Desktop Window Manager has registered the session port.  "
053,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:51 AM,6003,None,"The winlogon notification subscriber <TrustedInstaller> was unavailable to handle a critical notification event.  "
052,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:51 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
051,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:46 AM,8197,None,"SLUI.exe was launched with the following command-line parameters:  RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;NotificationInterval=1440;Trigger=UserLogon;SessionId=1  "
050,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:46 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129600)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
049,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:46 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129600)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
048,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:46 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129600)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
047,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:46 AM,8197,None,"SLUI.exe was launched with the following command-line parameters:  RuleId=379cccfb-d4e0-48fe-b0f2-0136097be147;Action=CleanupState;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;Trigger=TimerEvent  "
046,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:46 AM,8230,None,"The rules engine successfully re-evaluated the schedule.  Kernel policies:  Security-SPP-Action-StateData (REG_SZ) =AppId=55c92734-d682-4d71-983e-d6ec3f16059f;GraceEndDate=2018/01/15:18:13:46;LastConsumptionReason=0x4004fc04;LastNotificationId=Cleanup;LicenseState=SL_LICENSING_STATUS_LICENSED;PartialProductKey=YG9R6;ProductKeyType=Retail:TB:Eval;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;ruleId=379cccfb-d4e0-48fe-b0f2-0136097be147;uxDifferentiator=TIMEBASED_EVAL  "
045,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:46 AM,12311,None,"The MSA client has been successfully triggered to update the Device License  "
044,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:45 AM,1037,None,"Time-based license remaining validity time 129600 minutes.  "
043,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:45 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 1 [(0 [0x00000000, 1, 0], [(?)( 1 0x00000000)(?)( 2 0x00000000 0 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)( 9 0x00000000 90 129600)( 10 0x00000000 msft:rm/algorithm/flags/1.0)(?)])(1 )(2 )(3 )]    "
042,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:45 AM,1033,None,"These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=55c92734-d682-4d71-983e-d6ec3f16059f  Sku Id=3f4c0546-36c6-46a8-a37f-be13cdd0cf25  "
041,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:45 AM,1034,None,"Duplicate definition of policy found. Policy name=Security-SPP-Reserved-LicenseProperties  Priority=100  "
040,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:45 AM,1036,None,"Validity period has been started. Validity minutes=129600  Grace type=9.  "
039,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:45 AM,12304,None,"Successfully acquired genuine ticket for template Id {99d92734-d682-4d71-983e-d6ec3f16059f}  "
038,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:45 AM,12305,None,"Genuine state set to genuine for application Id 55c92734-d682-4d71-983e-d6ec3f16059f  "
037,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:44 AM,20489,None,"Genuine validation data collection ended.     "
036,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:44 AM,916,None,"svchost (1364,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
035,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:44 AM,1034,None,"Duplicate definition of policy found. Policy name=Security-SPP-WriteWauMarker  Priority=500  "
034,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:43 AM,20482,None,"Health check passed.     "
033,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:42 AM,20481,None,"Health check initiated.     "
032,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:40 AM,20488,None,"Genuine validation data collection started.     "
031,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:39 AM,1067,None,"Genuine information set for application. 0x00000000, 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, SL_ACTIVATION_VALIDATION_IN_PROGRESS.    "
030,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:39 AM,1004,None,"The Software Protection service has successfully installed the license.  License Title=XrML 2.1 License - {msft:sl/EUL/ACTIVATED/PRIVATE}  License Id=679425b7-fa94-4058-abc8-b6e7231086f4  "
029,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:39 AM,1004,None,"The Software Protection service has successfully installed the license.  License Title=XrML 2.1 License - {msft:sl/EUL/ACTIVATED/PUBLIC}  License Id=fc63c759-52f0-4f2d-adff-0f4890d42804  "
028,Application,Software Protection Platform Service,UNKNOWN TYPE,MSEDGEWIN10,10/17/2017 10:13:39 AM,1013,None,"Acquisition of End User License was successful.  Sku Id=3f4c0546-36c6-46a8-a37f-be13cdd0cf25  "
027,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:36 AM,8230,None,"The rules engine successfully re-evaluated the schedule.  Kernel policies:  Security-SPP-Action-StateData (REG_SZ) =AppId=55c92734-d682-4d71-983e-d6ec3f16059f;LastConsumptionReason=0xc004f009;LastNotificationId=NeverActivated;LicenseState=SL_LICENSING_STATUS_NOTIFICATION;PartialProductKey=YG9R6;ProductKeyType=Retail:TB:Eval;SkuId=3f4c0546-36c6-46a8-a37f-be13cdd0cf25;ruleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;uxDifferentiator=TIMEBASED_EVAL  "
026,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:34 AM,916,None,"taskhostw (4228,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
025,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:33 AM,916,None,"svchost (4284,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
024,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:31 AM,4112,None,"Successful auto update of disallowed certificate list with effective date: ?Thursday, ?April ?20, ?2017 8:59:32 AM.  "
023,Application,Microsoft-Windows-CAPI2,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:31 AM,4097,None,"Successful auto update of third-party root certificate:: Subject: <CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE> Sha1 thumbprint: <D4DE20D05E66FC53FE1A50882C78DB2852CAE474>.  "
022,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:30 AM,6000,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.  "
021,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:30 AM,6003,None,"The winlogon notification subscriber <SessionEnv> was unavailable to handle a critical notification event.  "
020,Application,Wlclntfy,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:29 AM,6003,None,"The winlogon notification subscriber <TrustedInstaller> was unavailable to handle a critical notification event.  "
019,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:27 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
018,Application,Windows Search Service Profile Notification,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:26 AM,5,None,"Windows Search Service has created default configuration for new user 'MSEDGEWIN10\defaultuser0' .  "
017,Application,Microsoft-Windows-WMI,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:25 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
016,Application,ESENT,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:25 AM,916,None,"svchost (2732,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
015,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:24 AM,1003,None,"The Windows Search Service started.   "
014,Application,Windows Search Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:24 AM,1005,None,"The Windows Search Service has successfully created the new search index.    "
013,Application,WLMS,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:24 AM,100,None,"Message text not available. "
012,Application,Microsoft-Windows-User Profiles Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:22 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
011,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:22 AM,1003,None,"The Software Protection service has completed licensing status check.  Application Id=55c92734-d682-4d71-983e-d6ec3f16059f  Licensing Status= 1: 3f4c0546-36c6-46a8-a37f-be13cdd0cf25, 1, 0 [(0 )(1 )(2 )(3 [0x00000000, 0, 0], [( 6 0xC004F009 0 0)( 1 0x00000000)( 6 0xC004F009 0 0)(?)(?)(?)( 10 0x00000000 msft:rm/algorithm/flags/1.0)( 11 0x00000000 0xC004F009)])]    "
010,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:22 AM,1034,None,"Duplicate definition of policy found. Policy name=Security-SPP-WriteWauMarker  Priority=500  "
009,Application,Software Protection Platform Service,INFORMATION,MSEDGEWIN10,10/17/2017 10:13:22 AM,1016,None,"Proof of Purchase installed successfully.   ACID=3f4c0546-36c6-46a8-a37f-be13cdd0cf25  PKeyId=e90357b0-ef56-b92d-2f9d-5571b23db028  "
008,Application,Microsoft-Windows-User Profiles Service,INFORMATION,IEUSER-Q61L06H5,10/17/2017 10:12:56 AM,1532,SYSTEM\NT AUTHORITY,"The User Profile Service has stopped.        "
007,Application,ESENT,INFORMATION,IEUSER-Q61L06H5,10/17/2017 10:12:50 AM,916,None,"svchost (3500,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
006,Application,Microsoft-Windows-WMI,INFORMATION,IEUSER-Q61L06H5,10/17/2017 10:12:37 AM,5617,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service subsystems initialized successfully  "
005,Application,ESENT,INFORMATION,IEUSER-Q61L06H5,10/17/2017 10:11:38 AM,916,None,"svchost (2152,G,0) ?The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.  "
004,Application,Microsoft-Windows-WMI,INFORMATION,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,5615,SYSTEM\NT AUTHORITY,"Windows Management Instrumentation Service started sucessfully  "
003,Application,WLMS,INFORMATION,IEUSER-Q61L06H5,10/17/2017 10:11:37 AM,100,None,"Message text not available. "
002,Application,Microsoft-Windows-User Profiles Service,INFORMATION,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,1531,SYSTEM\NT AUTHORITY,"The User Profile Service has started successfully.        "
001,Application,EventSystem,INFORMATION,IEUSER-Q61L06H5,10/17/2017 10:11:35 AM,4625,None,"Message text not available.  Insertion strings: 86400 SuppressDuplicateDuration Software\Microsoft\EventSystem\EventLog  "
